Rename Command

Use this command to change the name of a field.

After the name of a field has been changed through the Search bar, you can view the original field name and the changed field name from the UI.

Syntax

|rename <field> as <new_field>

Parameters

The following table lists the parameters used with this command, along with their descriptions.

Parameter Description

field

Use this parameter to specify the original name of the field.

new_field

Use this parameter to specify the new name of the field.

For examples of using this command in typical scenarios, see:

The following query returns the count of logs from the different log sources, and renames the field Host IP Address (Client) and clientIP.

*|stats count by 'Log Source'|rename 'Host IP Address (Client)' as clientip