rename command overview
rename command to rename one or more fields. This command is useful for giving fields more meaningful names, such as
Product ID instead of
pid. If you want to rename fields with similar names, you can use a wildcard character.
The required syntax is in bold.
- <wc-source-field> AS <wc-target-field> ["," <wc-source-field> AS <wc-target-field>]...
How the rename command works
rename command to rename a field in your search results.
Sometimes a field name in your data is an abbreviation and it's useful to rename the field so that others clearly understand what data the field shows.
Suppose you have a field called
dpt, which could an abbreviation for all sorts of things like:
- Dollar per Transaction
- Days Prior To
- Dew Point Temperature
- Double Plays Turned
You can make the field name clearer to anyone viewing the search results by renaming the field:
... | rename dpt AS department
Field names with special characters
When you rename a field and specify a name that has a space, you need to enclose the name in single quotation marks. Here's an example:
... | rename productName AS 'Product Name'
You must use single quotation marks on field names that include special characters, spaces, dashes, and wildcards. See Quotation marks in the SPL2 Search Manual.
Commands and clauses with built-in renaming options
Some commands, such as
stats, have a built-in rename option using the AS keyword. When you use a statistical function, the field that the
stats command creates in the search results includes the function name. For example, your search calculates the average of the
... | stats avg(bytes)
The field in the output is named
avg(bytes) by default. You can rename the field using the AS keyword:
... | stats avg(bytes) AS 'average bytes'
Similarly, you can specify an expression in the SELECT clause in the
from command that includes a rename. For example:
SELECT count(action) AS 'Action Count'...
mvexpand command examples
rename command syntax details
This documentation applies to the following versions of Splunk® Cloud Services: current