https://community.splunk.com/t5/Getting-Data-In/Source-Names/m-p/78231#M16005 <P>No, "source" is an indexed field that cannot be changed once it's set.</P> <P>You could possibly create lookup files that map input sources to more descriptive names, and then look at the field(s) created by the lookup. That could apply to all results, not just newly indexed ones.</P> Tue, 19 Jun 2012 11:30:51 GMT Ayn 2012-06-19T11:30:51Z https://community.splunk.com/t5/Getting-Data-In/Source-Names/m-p/78230#M16004 <P>Hi,</P> <P>We have a Splunk system set up. When we log into splunk and go to the search dashboard, all the sources appear with the IP and port eg: 10.12.34.56:1001<BR /> We would like to be able to see a more descriptive representation of the url, rather than the IP e.g. Application Server 1</P> <P>We know this can be achieved by setting the source = "Application Server 1" in inputs.conf. However, when we do so, all the logs which are already indexed do not appear under Application Server 1 but they remain under 10.12.34.56:1001.</P> <P>Is there a way how to change the source of the logs which are already received?</P> <P>Thanks</P> <P>Simon</P> Tue, 19 Jun 2012 11:20:40 GMT https://community.splunk.com/t5/Getting-Data-In/Source-Names/m-p/78230#M16004 simonattardGO 2012-06-19T11:20:40Z https://community.splunk.com/t5/Getting-Data-In/Source-Names/m-p/78231#M16005 <P>No, "source" is an indexed field that cannot be changed once it's set.</P> <P>You could possibly create lookup files that map input sources to more descriptive names, and then look at the field(s) created by the lookup. That could apply to all results, not just newly indexed ones.</P> Tue, 19 Jun 2012 11:30:51 GMT https://community.splunk.com/t5/Getting-Data-In/Source-Names/m-p/78231#M16005 Ayn 2012-06-19T11:30:51Z