rename command to rename one or more fields. This command is useful for giving fields more meaningful names, such as "Product ID" instead of "pid". If you want to rename fields with similar names, you can use a wildcard character.
See the Usage section.
rename <wc-field> AS <wc-field>...
- Syntax: <string>
- Description: The name of a field and the name to replace it. You can use wild card characters in the field names. Names with spaces must be enclosed in quotation marks.
Rename with a phrase
Use quotes to rename a field to a phrase.
... | rename SESSIONID AS "The session ID"
Rename multiple, similarly named fields
Use wildcards to rename multiple fields.
... | rename *ip AS *IPaddress
If both the source and destination fields are wildcard expressions with the same number of wildcards, the renaming will carry over the wildcarded portions to the destination expression. See Examples.
You cannot rename one field with multiple names
You cannot rename one field with multiple names. For example if you have field A, you cannot specify
| rename A as B, A as C. This rule also applies to other commands where you can rename fields, such as the
The following example is not valid.
... | stats first(host) AS site, first(host) AS report
You cannot merge multiple fields into one field
You cannot use the
rename command to merge multiple fields into one field because null, or non-present, fields are brought along with the values.
For example, if you have events with either
... | rename pid AS product_id would not merge the
pid values into the
product_id field. It overwrites
product_id with Null values where
pid does not exist for the event. See the eval command and coalesce() function.
Rename the "_ip" field to "IPAddress".
... | rename _ip AS IPAddress
Rename fields beginning with "foo" to begin with "bar".
... | rename foo* AS bar*
Rename the "count" field. Names with spaces must be enclosed in quotation marks.
... | rename count AS "Count of Events"
Have questions? Visit Splunk Answers and see what questions and answers the Splunk community has using the rename command.
This documentation applies to the following versions of Splunk® Enterprise: 6.3.0, 6.3.1, 6.3.2, 6.3.3, 6.3.4, 6.3.5, 6.3.6, 6.3.7, 6.3.8, 6.3.9, 6.3.10, 6.3.11, 6.3.12, 6.3.13, 6.3.14, 6.4.0, 6.4.1, 6.4.2, 6.4.3, 6.4.4, 6.4.5, 6.4.6, 6.4.7, 6.4.8, 6.4.9, 6.4.10, 6.4.11