https://community.splunk.com/t5/Getting-Data-In/Can-we-rename-fields-in-transforms-conf/m-p/330760#M61295 <P>Perfect @skoelpin - the alias solution makes sense.</P> Mon, 23 Oct 2017 22:40:48 GMT ddrillic 2017-10-23T22:40:48Z https://community.splunk.com/t5/Getting-Data-In/Can-we-rename-fields-in-transforms-conf/m-p/330758#M61293 <P>In the following thread we extracted the name value pairs from the embedded json document - <A href="https://answers.splunk.com/answers/581928/how-can-we-extract-a-json-document-within-an-event.html">How can we extract a json document within an event?</A></P> <P>.We would like to rename some of these fields. Where can we do that?</P> Mon, 23 Oct 2017 18:03:15 GMT https://community.splunk.com/t5/Getting-Data-In/Can-we-rename-fields-in-transforms-conf/m-p/330758#M61293 ddrillic 2017-10-23T18:03:15Z https://community.splunk.com/t5/Getting-Data-In/Can-we-rename-fields-in-transforms-conf/m-p/330759#M61294 <P>You could always create an alias for the existing fields. Removing and renaming fields may be difficult if you have a lot of data in there</P> <P><A href="https://docs.splunk.com/Documentation/Splunk/7.0.0/Knowledge/Addaliasestofields">https://docs.splunk.com/Documentation/Splunk/7.0.0/Knowledge/Addaliasestofields</A></P> Mon, 23 Oct 2017 22:19:43 GMT https://community.splunk.com/t5/Getting-Data-In/Can-we-rename-fields-in-transforms-conf/m-p/330759#M61294 skoelpin 2017-10-23T22:19:43Z https://community.splunk.com/t5/Getting-Data-In/Can-we-rename-fields-in-transforms-conf/m-p/330760#M61295 <P>Perfect @skoelpin - the alias solution makes sense.</P> Mon, 23 Oct 2017 22:40:48 GMT https://community.splunk.com/t5/Getting-Data-In/Can-we-rename-fields-in-transforms-conf/m-p/330760#M61295 ddrillic 2017-10-23T22:40:48Z