Splunk Examples: Renaming/Replacing Fields and Values

Last updated:
Table of Contents

WIP Alert This is a work in progress. Current information is correct but more content may be added in the future.

Splunk version used: 8.2.6. Examples use the tutorial data from Splunk

Rename field with eval

Just use eval to create a new field that's a copy an another one:

| eval NewField=OldField

added-new-field-based-on-current-one Created a new field called NewField based upon Code

Replace value using case

If value is "B", replace with "Biscuits". If value is "C", replace with "Carrots".

| eval Code=case(Code="B", "Biscuits", Code="C", "Carrots", true(), "Other")
| table _raw, Code

source-data Sample data, (source_type is vendor_sales)
data-with-replaced-values After: replaced values

Dialogue & Discussion