To rename a field in Splunk, you use the 'rename' command followed by the old field name 'as' and then the new field name within double quotes if it contains spaces. The correct syntax is '| rename action as "Customer Action"'. Option D follows this format correctly.