通过重命名搜索元素来格式化splunk查询

Question

我可以使用一些我正在尝试使用的splunk查询帮助。

此查询适用于收集我需要的信息：

index=prd_aws_billing (source="/*2017-12.csv") LinkedAccountId="1234567810" OR LinkedAccountId="123456789" ProductName="Amazon Elastic Compute Cloud" | stats sum(UnBlendedCost) AS Cost by ResourceId,UsageType,user_Name,user_Engagement

但是我想稍微改进一下。我想将user_Engagement表示为Engagement，将user_Name表示为“资源名称”。

我尝试使用AS来更改输出，就像我将UnBlendedCost更改为“Cost”一样。但是，当我这样做时，它会终止我的查询，并且不会返回任何内容。例如，如果我这样做：

index=prd_aws_billing (source="/*2017-12.csv") LinkedAccountId="123456789" OR LinkedAccountId="1234567810" ProductName="Amazon Elastic Compute Cloud" | stats sum(UnBlendedCost) AS Cost by ResourceId AS “Resource Name”,UsageType,user_Name,user_Engagement AS “Engagement”

要么

index=prd_aws_billing (source="/*2017-12.csv") LinkedAccountId="123456789" OR LinkedAccountId="1234567819" ProductName="Amazon Elastic Compute Cloud" ResourceID AS “Resource Name” user_Engagement AS “Engagement” | stats sum(UnBlendedCost) AS Cost by ResourceId AS “Resource Name”,UsageType,user_Name,user_Engagement AS “Engagement”

查询将终止，并且不会返回任何信息。如何重新格式化'by'子句后列出的搜索元素？

Answer 1

使用| rename命令。您只能使用AS重命名在| stats中转换的字段。

index=prd_aws_billing (source="/*2017-12.csv") LinkedAccountId="1234567810" OR LinkedAccountId="123456789" ProductName="Amazon Elastic Compute Cloud" 
| stats sum(UnBlendedCost) AS Cost by ResourceId,UsageType,user_Name,user_Engagement
| rename user_Name as "Resource Name" user_Engagement as Engagement