rename command syntax details
Syntax
The required syntax is in bold.
- rename
- <source-field> AS <target-field> ["," <source-field> AS <target-field>]...
The AS keyword is displayed in uppercase in the syntax and examples to make the syntax easier to read. You can specify the AS keyword in uppercase or lowercase.
Required arguments
- source-field
- Syntax: <string>
- Description: The name of a field in your search results to rename. You can use a wild card character in the field name. Names with anything other than a-z, A-Z, 0-9, or the underscore ( _ ) character must be enclosed in single-quotation marks. This includes the wildcard character ( * ).
- target-field
- Syntax: AS <string>
- Description: The name you want to use as the replacement name for the field. You can use a wild card character in the field name. Names with anything other than a-z, A-Z, 0-9, or the underscore ( _ ) character must be enclosed in single-quotation marks. This includes the wildcard character ( * ).
- The replacement name you specify for the field can't be a reserved word. For a list of the reserved words, see Reserved words.
See also
- rename command
- rename command overview
- rename command usage
- rename command examples
rename command overview | rename command usage |
This documentation applies to the following versions of Splunk® Cloud Services: current
Feedback submitted, thanks!