
rename
Description
Use the rename
command to rename one or more fields. This command is useful for giving fields more meaningful names, such as "Product ID" instead of "pid". If you want to rename fields with similar names, you can use a wildcard character.
See the Usage section.
Syntax
rename <wc-field> AS <wc-field>...
Required arguments
- wc-field
- Syntax: <string>
- Description: The name of a field and the name to replace it. Field names with spaces must be enclosed in quotation marks. You can use the asterisk ( * ) as a wildcard to specify a list of fields with similar names. For example, if you want to specify all fields that start with "value", you can use a wildcard such as
value*
.value*
.
Usage
The rename
command is a distributable streaming command. See Command types.
Rename with a phrase
Use quotation marks when you rename a field with a phrase.
... | rename SESSIONID AS "The session ID"
Rename multiple, similarly named fields
Use wildcards to rename multiple fields.
... | rename *ip AS *IPaddress
If both the source and destination fields are wildcard expressions with the same number of wildcards, the renaming will carry over the wildcarded portions to the destination expression. See Examples.
You cannot rename one field with multiple names
You cannot rename one field with multiple names. For example if you have field A, you cannot specify | rename A as B, A as C
. This rule also applies to other commands where you can rename fields, such as the stats
command.
The following example is not valid.
... | stats first(host) AS site, first(host) AS report
You cannot merge multiple fields into one field
You cannot use the rename
command to merge multiple fields into one field because null, or non-present, fields are brought along with the values.
For example, if you have events with either product_id
or pid
fields, ... | rename pid AS product_id
would not merge the pid
values into the product_id
field. It overwrites product_id
with Null values where pid
does not exist for the event. See the eval command and coalesce() function.
Renaming a field that does not exist
Renaming a field can cause loss of data.
Suppose you rename fieldA to fieldB, but fieldA does not exist.
- If fieldB does not exist, nothing happens.
- If fieldB does exist, the result of the rename is that the data in fieldB is removed. The data in fieldB will contain null values.
Examples
Example 1:
Rename the "_ip" field to "IPAddress".
... | rename _ip AS IPAddress
Example 2:
Rename fields beginning with "foo" to begin with "bar".
... | rename foo* AS bar*
Example 3:
Rename the "count" field. Names with spaces must be enclosed in quotation marks.
... | rename count AS "Count of Events"
See also
PREVIOUS reltime |
NEXT replace |
This documentation applies to the following versions of Splunk® Enterprise: 6.5.7, 7.0.0, 7.0.1, 7.0.2, 7.0.3, 7.0.4, 7.0.5, 7.0.6, 7.0.7, 7.0.8, 7.0.9, 7.0.10, 7.0.11, 7.0.13, 7.1.0, 7.1.1, 7.1.2, 7.1.3, 7.1.4, 7.1.5, 7.1.6, 7.1.7, 7.1.8, 7.1.9, 7.1.10, 7.2.0, 7.2.1, 7.2.2, 7.2.3, 7.2.4, 7.2.5, 7.2.6, 7.2.7, 7.2.8, 7.2.9, 7.2.10, 7.3.0, 7.3.1, 7.3.2, 7.3.3, 7.3.4, 7.3.5, 7.3.6, 7.3.7, 7.3.8, 7.3.9, 8.0.1, 8.0.3, 8.0.4, 8.0.5, 8.0.6, 8.0.7, 8.0.8, 8.0.9, 8.1.0, 8.1.1, 8.1.2, 8.1.3, 8.1.4, 8.1.5, 8.1.6, 8.1.7, 8.1.8, 8.1.9, 8.1.10, 8.1.11, 8.1.12, 8.1.13, 8.1.14, 8.2.0, 8.2.1, 8.2.2, 8.2.3, 8.2.4, 8.2.5, 8.2.6, 8.2.7, 8.2.8, 8.2.9, 8.2.10, 8.2.11, 9.0.0, 9.0.1, 9.0.2, 9.0.3, 9.0.4, 9.0.5, 8.0.0, 8.0.10, 8.0.2
Feedback submitted, thanks!