topic SEDCMD to change field name in Getting Data In

SEDCMD to change field name

saifuddin9122 — Tue, 07 Feb 2017 15:19:51 GMT

Hello
i have a log event as
DEBUG 2017.02.06 17:15:35.385: (common.work) Parsed source address, source='10.0.0.2' i want to change the source as src_ip at index time

can any one help me ?

Thanks in advance

Re: SEDCMD to change field name

somesoni2 — Tue, 07 Feb 2017 15:25:53 GMT

Try like this (props.conf on Indexer/heavy forwarder)

[YourSourceType]
...other settings..
SEDCMD-srcip = s/,\s+source=/, src_ip=/g

Re: SEDCMD to change field name

twinspop — Tue, 07 Feb 2017 15:25:53 GMT

SEDCMD-source = s/, source=/, src_ip=/

Although I think a better option is to use a field alias. Settings -> Fields -> Field aliases