https://community.splunk.com/t5/Getting-Data-In/Rename-fields-in-Props-conf/m-p/97747#M20380 <P>You can do this in props.conf. Both fields will be visible.</P> <P><CODE>[my_sourcetype]<BR /> FIELDALIAS-alias1 = ip AS clientip<BR /> FIELDALIAS-alias2 = uri-query AS uri<BR /> etc...</CODE></P> Wed, 17 Apr 2013 14:48:09 GMT alacercogitatus 2013-04-17T14:48:09Z https://community.splunk.com/t5/Getting-Data-In/Rename-fields-in-Props-conf/m-p/97746#M20379 <P>I have some old iis logging going on in our web logs, and I am looking to rename some of the fields that I'm pulling out via transforms.conf. </P> <P>The fields that I'm looking to rename in props look like this. </P> <P>I would like to change "ip" to "clientip"<BR /> I would like to change "uri-query" to "uri" <BR /> and a few more. </P> <P>Can this be done in the props.conf? </P> <P>Travis</P> Wed, 17 Apr 2013 14:38:03 GMT https://community.splunk.com/t5/Getting-Data-In/Rename-fields-in-Props-conf/m-p/97746#M20379 tmarlette 2013-04-17T14:38:03Z https://community.splunk.com/t5/Getting-Data-In/Rename-fields-in-Props-conf/m-p/97747#M20380 <P>You can do this in props.conf. Both fields will be visible.</P> <P><CODE>[my_sourcetype]<BR /> FIELDALIAS-alias1 = ip AS clientip<BR /> FIELDALIAS-alias2 = uri-query AS uri<BR /> etc...</CODE></P> Wed, 17 Apr 2013 14:48:09 GMT https://community.splunk.com/t5/Getting-Data-In/Rename-fields-in-Props-conf/m-p/97747#M20380 alacercogitatus 2013-04-17T14:48:09Z https://community.splunk.com/t5/Getting-Data-In/Rename-fields-in-Props-conf/m-p/97748#M20381 <P>Adding</P> <PRE><CODE>[my_sourcetype] # ... EVAL-ip = null EVAL-uri-query = null # ... </CODE></PRE> <P>will also hide the original fields.</P> Wed, 17 Jun 2015 12:01:26 GMT https://community.splunk.com/t5/Getting-Data-In/Rename-fields-in-Props-conf/m-p/97748#M20381 krdo 2015-06-17T12:01:26Z