Description
Use the rename command to rename one or more fields. This command is useful for giving fields more meaningful names, such as "Product ID" instead of "pid". If you want to rename fields with similar names, you can use a wildcard character.See the Usage section.
Syntax
rename <wc-field> AS <wc-field>...
Required arguments
- wc-field
- Syntax: <string>
- Description: The name of a field and the name to replace it. Field names with spaces must be enclosed in quotation marks. You can use the asterisk ( * ) as a wildcard to specify a list of fields with similar names. For example, if you want to specify all fields that start with "value", you can use a wildcard such as
value*.
Usage
The rename command is a distributable streaming command. See Command types.
Rename with a phrase
Use quotation marks when you rename a field with a phrase.
... | rename SESSIONID AS "The session ID"
Rename multiple, similarly named fields
Use wildcards to rename multiple fields with similar names. For example, suppose you have the following field names:
- EU_UK
- EU_DE
- EU_PL
You can rename the fields to replace EU with EMEA:
... | rename EU* AS EMEA*
The results show these field names:
- EMEA_UK
- EMEA_DE
- EMEA_PL
Both the original and renamed fields must include the same number of wildcards, otherwise a wildcard mismatch error is returned. See Examples.
You can't rename one field with multiple names
You can't rename one field with multiple names. For example if you have field A, you can't specify | rename A as B, A as C. This rule also applies to other commands where you can rename fields, such as the stats command.
The following example is not valid:
... | stats first(host) AS site, first(host) AS report
You can't merge multiple fields into one field
You can't use the rename command to merge multiple fields into one field because null, or non-present, fields are brought along with the values.
For example, if you have events with either product_id or pid fields, ... | rename pid AS product_id would not merge the pid values into the product_id field. It overwrites product_id with Null values where pid does not exist for the event. See the eval command and coalesce() function.
You can't match wildcard characters while renaming fields
You can use the asterisk (*) in your searches as a wildcard character, but you can't use a backslash (\) to escape an asterisk in search strings. A backslash \ and an asterisk * match the characters \* in searches, not an escaped wildcard character. Because the Splunk platform doesn't support escaping wildcards, asterisk (*) characters in field names in rename searches can't be matched and replaced.
Renaming a field that does not exist
Renaming a field can cause loss of data.
Suppose you rename fieldA to fieldB, but fieldA does not exist.
- If fieldB does not exist, nothing happens.
- If fieldB does exist, the result of the rename is that the data in fieldB is removed. The data in fieldB will contain null values.
The original and new field names must have the same number of wildcards
The number of asterisks (*) in the original name must match the number of asterisks in the new name. For example, the following search fails because there is one wildcard character in the original name, but none in the name that replaces it:
... | rename price-a*price-b AS price-a\price-b
The following search completes successfully because the number of wildcard characters in both names is the same.
... | rename price-a*price-b AS price-a*Newprice-b
Support for backslash characters (\) in the rename command
To match a backslash character (\) in a field name when using the rename command, use 2 backslashes for each backslash in the original field name. For example, to rename the field name http\\:8000 to localhost:8000, use the following command in your search:
... | rename http\\\\:* AS localhost:*
See Backslashes in the Search Manual.
Examples
1. Rename a single field
Rename the "_ip" field to "IPAddress".
... | rename _ip AS IPAddress
2. Rename fields with similar names using a wildcard
Rename fields that begin with "usr" to begin with "user".
... | rename usr* AS user*
3. Specifying a field name that contains spaces
Rename the "count" field. Names with spaces must be enclosed in quotation marks.
... | rename count AS "Count of Events"
See also
- Commands
- fields
- replace
- table
Last modified on 06 October, 2023
| reltime | replace |
This documentation applies to the following versions of Splunk® Enterprise: 7.0.0, 7.0.2, 7.0.3, 7.0.4, 7.0.5, 7.0.6, 7.0.7, 7.0.8, 7.0.9, 7.0.10, 7.0.11, 7.0.13, 7.1.0, 7.1.1, 7.1.2, 7.1.3, 7.1.4, 7.1.5, 7.1.6, 7.1.7, 7.1.8, 7.1.9, 7.1.10, 7.2.0, 7.2.1, 7.2.2, 7.2.4, 7.2.5, 7.2.6, 7.2.7, 7.2.8, 7.2.9, 7.2.10, 7.3.0, 7.3.1, 7.3.2, 7.3.3, 7.3.4, 7.3.5, 7.3.6, 7.3.7, 7.3.8, 7.3.9, 8.0.0, 8.0.1, 8.0.2, 8.0.3, 8.0.4, 8.0.5, 8.0.6, 8.0.10, 8.1.0, 7.2.3, 8.0.8, 7.0.1, 8.0.7, 8.1.2, 8.1.3, 8.1.4, 8.1.5, 8.1.6, 8.1.7, 8.1.8, 8.1.9, 8.1.11, 8.1.12, 8.1.13, 8.1.14, 8.2.0, 8.2.1, 8.2.2, 8.2.3, 8.2.4, 8.2.5, 8.2.6, 8.2.7, 8.2.8, 8.2.9, 8.2.10, 8.2.11, 8.2.12, 9.0.0, 9.0.1, 9.0.2, 9.0.3, 9.0.4, 9.0.5, 9.0.6, 9.0.7, 9.0.8, 9.0.9, 9.0.10, 9.1.0, 9.1.1, 9.1.2, 9.1.3, 9.1.4, 9.1.5, 9.2.0, 9.2.1, 9.2.2, 8.0.9, 8.1.1, 8.1.10
