Splunk® Enterprise

Search Reference

Download manual as PDF

This documentation does not apply to the most recent version of Splunk. Click here for the latest version.
Download topic as PDF



Use the rename command to rename one or more fields. This command is useful for giving fields more meaningful names, such as "Product ID" instead of "pid". If you want to rename fields with similar names, you can use a wildcard character. See the Usage section.


rename <wc-field> AS <wc-field>...

Required arguments

Syntax: <string>
Description: The name of a field and the name to replace it. You can use wild card characters in the field names. Names with spaces must be enclosed in quotation marks.


Rename with a phrase

Use quotes to rename a field to a phrase.

... | rename SESSIONID AS "The session ID"

Rename multiple, similarly named fields

Use wildcards to rename multiple fields.

... | rename *ip AS *IPaddress

If both the source and destination fields are wildcard expressions with the same number of wildcards, the renaming will carry over the wildcarded portions to the destination expression. See Examples.

You cannot rename one field with multiple names

You cannot rename one field with multiple names. For example if you have field A, you cannot specify | rename A as B, A as C. This rule also applies to other commands where you can rename fields, such as the stats command.

The following example is not valid.

... | stats first(host) AS site, first(host) AS report

You cannot merge multiple fields into one field

You cannot use the rename command to merge multiple fields into one field because null, or non-present, fields are brought along with the values.

For example, if you have events with either product_id or pid fields, ... | rename pid AS product_id would not merge the pid values into the product_id field. It overwrites product_id with Null values where pid does not exist for the event. See the eval command and coalesce() function.


Example 1:

Rename the "_ip" field to "IPAddress".

... | rename _ip AS IPAddress

Example 2:

Rename fields beginning with "foo" to begin with "bar".

... | rename foo* AS bar*

Example 3:

Rename the "count" field. Names with spaces must be enclosed in quotation marks.

... | rename count AS "Count of Events"

See also

fields, table


Have questions? Visit Splunk Answers and see what questions and answers the Splunk community has using the rename command.


This documentation applies to the following versions of Splunk® Enterprise: 6.0, 6.0.1, 6.0.2, 6.0.3, 6.0.4, 6.0.5, 6.0.6, 6.0.7, 6.0.8, 6.0.9, 6.0.10, 6.0.11, 6.0.12, 6.0.13, 6.0.14, 6.0.15, 6.1, 6.1.1, 6.1.2, 6.1.3, 6.1.4, 6.1.5, 6.1.6, 6.1.7, 6.1.8, 6.1.9, 6.1.10, 6.1.11, 6.1.12, 6.1.13, 6.1.14, 6.2.0, 6.2.1, 6.2.2, 6.2.3, 6.2.4, 6.2.5, 6.2.6, 6.2.7, 6.2.8, 6.2.9, 6.2.10, 6.2.11, 6.2.12, 6.2.13, 6.2.14, 6.2.15, 6.3.0, 6.3.1, 6.3.2, 6.3.3, 6.3.4, 6.3.5, 6.3.6, 6.3.7, 6.3.8, 6.3.9, 6.3.10, 6.3.11, 6.3.12, 6.3.13, 6.3.14, 6.4.0, 6.4.1, 6.4.2, 6.4.3, 6.4.4, 6.4.5, 6.4.6, 6.4.7, 6.4.8, 6.4.9, 6.4.10, 6.4.11


Wbfoxii - You are absolutely correct! I've fixed this on the example. Thanks for catching this :-)

Lstewart splunk, Splunker
September 10, 2015

In Example 3, don't you want spaces in Count of Events? Otherwise, why do you need the double quotes?

September 10, 2015

Seanel, you can use "*" in the rename command for limited flexibility, but not regex. For instance, rename xyz_* AS * turns xyz_abc into abc and xyz_def into def.

July 16, 2015

I would like to note that rename does not like the use of double quotes created by my email application and only likes the double quotes created by typing into Notepad++ or the Search line, etc. Outlook email " “ " vs Splunk search line " " " If you get an error from the rename command with referencing to format with AS or TO, it may be referencing this issue.

July 16, 2015

Is it possible to use regex in the rename command? This would make it a lot more powerful and a lot more useful. If so then an example would be good here

May 22, 2015

Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters