topic Re: Change field names of indexed data in Getting Data In

Change field names of indexed data

JeremyHagan — Tue, 29 Sep 2020 09:35:11 GMT

Hi,
I've got a particular source type which I would like to modify the field names of so that they are CIM compliant. Eg rename source_ip to src_ip.

The field names are specified in the tranforms.conf. I am assuming that these field extractions are just search time and aren't written into the index. Is this correct? Will the field name change be reflected against data already indexed?

Cheers,
Jeremy.

Re: Change field names of indexed data

esix_splunk — Mon, 02 May 2016 01:23:12 GMT

Once data is indexed, it is not changeable. You can only transform it ( field alias, extractions, etc) at search time. So you are correct.

Cheers
Eric

Re: Change field names of indexed data

woodcock — Mon, 02 May 2016 13:04:19 GMT

It depends. If you use REPORT- or EXTRACT- in props.conf, then the referenced extractions inside of transforms.conf happen at search-time, but if you call TRANSFORMS-, then they will happen at index-time. Read all about it here:

http://docs.splunk.com/Documentation/Splunk/6.2.5/admin/propsconf
http://docs.splunk.com/Documentation/Splunk/6.2.5/admin/transformsconf

Re: Change field names of indexed data

JeremyHagan — Mon, 02 May 2016 23:23:12 GMT

Good answer. Thanks. We are using REPORT-, so it is all good.

Re: Change field names of indexed data

woodcock — Tue, 03 May 2016 14:22:20 GMT

If you are all set then you should click Accept to close the question.