rename
Use the pipeline operator rename to assign a new name to a portion of the search query.
Syntax
... | rename source_name as new_source_name
where
-
source_name represents the field that you want to rename.
-
new_source_name represents the new name that you want to apply to the field.
Aliases that contain special characters have the following syntax restrictions:
| Special Characters | Restrictions | Examples |
|---|---|---|
| @, #, +, ?, /, ^, [], {}, _ , *, ., ~, $, % | Do not need to be enclosed in single/double quotes when they are reused and the search runs as expected. |
| rename source address as 'source@' | rename source@ as SA |
| &, !, - , = , <, >, | | Need to be enclosed in single/double quotes when they are reused and the search works as expected. | | rename source address as 'source&' | rename 'source&' as SA |
| \ |
When a backslash is used in an alias name, add an additional backslash \ to escape the character. It does not need to be enclosed in single/double quotes when it is reused and the search runs as expected. The outcome field name should show only one backslash. |
| rename source address as 'source\\' | rename source\\ as SA |
How Do I Use This?
-
Assign a new address name to an existing source address.
... | rename source_address as SourceAddressABC
For more information about other operators, functions, and syntax requirements, see Use an Operator in the Query.