Rename a column name to yesterday's date in 'dd-mon-yy' format

[kabiraj]

Hi All,

I want to rename a column name to yesterday's date written in 'dd-mon-yy' format.

Search:

sourcetype=shmapplogs "getMS3SAS ended for - deviceId" | top limit=0 showperc=0 channelId | lookup youview_channels.csv service_id_truncated AS channelId OUTPUT channel_name_letter | streamstats count AS position | fields channel_name_letter position | rename channel_name_letter as Channel position as "Popularity Index"

Result :

Channel           Popularity Index
BT Sport 1             1
BT Sport 2             2
Comedy Central         3
GOLD                     4 

I want to rename the "Popularity Index" to yesterday's date which should be dynamic i.e for today it should be "09-Jun-15".
Results for today should look like :

Channel            09-Jun-15
BT Sport 1          1
BT Sport 2          2
Comedy Central      3
GOLD                  4 

Is it possible? Please reply.

[woodcock · Accepted solution]

You cannot do it with rename but you can clone the old field with an eval trick and then throw away the old field like this:

 ... | eval NewName = now() - (60*60*24) | eval NewName = strftime(NewName , "%ddm%Y") | eval {NewName} = "Popularity Index" | fields - "Popularity Index"

http://answers.splunk.com/answers/186312/method-to-rename-field-to-value-of-another-field.html

[kabiraj]

Thanks woodcock! The method in the link works perfectly!