Page tree
Skip to end of metadata
Go to start of metadata
This search command changes the name of one or more fields with new names that you specify. You can use this command to simplify your troubleshooting tasks by changing complex field names to meaningful names. By using this command, you can rename a given field or multiple fields. Multiple fields can be separated by using a comma (,) or a space.

This topic contains the following information:

For a list of all search commands, see Search commands.


chgname <Source-Field> with <Target-Field>+

chgname <Source-Field> with "<Phrase>"+

In the preceding syntax, the following definitions apply:

  • + indicates one or more similar expressions separated by a comma (,) or space.
  • <Source-Field> refers to the field that you want to rename.
  • <Target-Field> refers to the new field name with which you want to replace the existing field name.
  • "<Phrase>" refers to the phrase with which you want to replace the existing field name. You must enclose a phrase in double quotes (").

Short examples

Example 1: Rename the COMPID field with ComponentID:

... | chgname COMPID with ComponentID

Example 2: Rename the COMPID field with the phrase Component ID:

... | chgname COMPID with "Component ID"

Long example

The following sample data and sample indexed data (displayed on the Search tab) will help you understand the examples of using the chgname command.

Sample data - - [11/Jul/2013:15:01:52 -0700] "GET /themes/ComBeta/images/bullet.png 
HTTP/1.1" 404 100 - - [11/Jul/2013:15:02:52 -0700] "GET /themes/ComBeta/images/bullet.png 
HTTP/1.1" 201 150 - - [11/Jul/2013:15:03:52 -0700] "PUT /themes/ComBeta/images/bullet.png 
HTTP/1.1" 201 200 - - [11/Jul/2013:15:04:52 -0700] "POST /themes/ComBeta/images/bullet.png 
HTTP/1.1" 200 100

Back to examples ↑

Sample indexed data - - [11/Jul/2013:15:04:52 -0700] "POST /themes/ComBeta/images/bullet.png 
HTTP/1.1" 200 100 |ResponseSize=100|COLLECTOR_NAME=u4 |ClientIp= |ResponseCode=200 |RequestType=POST|RequestURL=/themes/ComBeta/images/bullet.png - - [11/Jul/2013:15:03:52 -0700] "PUT /themes/ComBeta/images/bullet.png 
HTTP/1.1" 201 200 |ResponseSize=200|COLLECTOR_NAME=u4 |ClientIp= |ResponseCode=201 |RequestType=PUT|RequestURL=/themes/ComBeta/images/bullet.png - - [11/Jul/2013:15:02:52 -0700] "GET /themes/ComBeta/images/bullet.png 
HTTP/1.1" 201 150 |ResponseSize=150|COLLECTOR_NAME=u4 |ClientIp= |ResponseCode=201 |RequestType=GET|RequestURL=/themes/ComBeta/images/bullet.png - - [11/Jul/2013:15:01:52 -0700] "GET /themes/ComBeta/images/bullet.png 
HTTP/1.1" 404 100 |ResponseSize=100|COLLECTOR_NAME=u4 |ClientIp= |ResponseCode=404 |RequestType=GET|RequestURL=/themes/ComBeta/images/bullet.png

Back to examples ↑

chgname for multiple fields

In this example, you use the command to replace an existing field name with a new field name. See sample indexed data to understand how this command functions and to correlate the resulting output:


... | chgname RequestType with REQUEST_TYPE, ResponseSize with "RESPONSE SIZE"

Output - - [11/Jul/2013:15:04:52 -0700] "POST /themes/ComBeta/images/bullet.png 
HTTP/1.1" 200 100 |RESPONSE SIZE=100|COLLECTOR_NAME=u4 |ClientIp= |ResponseCode=200 |REQUEST_TYPE=POST|RequestURL=/themes/ComBeta/images/bullet.png - - [11/Jul/2013:15:03:52 -0700] "PUT /themes/ComBeta/images/bullet.png 
HTTP/1.1" 201 200 |RESPONSE SIZE=200|COLLECTOR_NAME=u4 |ClientIp= |ResponseCode=201 |REQUEST_TYPE=PUT|RequestURL=/themes/ComBeta/images/bullet.png - - [11/Jul/2013:15:02:52 -0700] "GET /themes/ComBeta/images/bullet.png 
HTTP/1.1" 201 150 |RESPONSE SIZE=150|COLLECTOR_NAME=u4 |ClientIp= |ResponseCode=201 |REQUEST_TYPE=GET|RequestURL=/themes/ComBeta/images/bullet.png - - [11/Jul/2013:15:01:52 -0700] "GET /themes/ComBeta/images/bullet.png 
HTTP/1.1" 404 100 |RESPONSE SIZE=100|COLLECTOR_NAME=u4 |ClientIp= |ResponseCode=404 |REQUEST_TYPE=GET|RequestURL=/themes/ComBeta/images/bullet.png

Back to examples ↑


  • After replacing the name of a particular field with a new name, you cannot search for the new name.
  • You cannot rename an existing (single) field with multiple names. For example, with an existing field X, you cannot replace X with Y and then replace X with Z in one search string.

    Example of an invalid syntax
    ... | chgname COMPID with site, COMPID with report
  • You cannot rename the default fields HOST, COLLECTOR_NAME, and DATA_PATTERN.

  • You cannot use default field names to specify a target field.
  • You cannot click a renamed field (or tag) to add it to the Fields section (on the Filters panel) or to your search criteria. However, you can use it in a subsequent search command by adding it to your search criteria.