https://community.splunk.com/t5/Getting-Data-In/Friendly-names-for-source/m-p/39314#M7304 <P>Use either the <CODE>eval</CODE> or <CODE>rex</CODE> search commands to modify or create a new field value. See: </P> <P><A href="http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/CommonEvalFunctions">http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/CommonEvalFunctions</A><BR /> <A href="http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Eval">http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Eval</A><BR /> or<BR /> <A href="http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Rex">http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Rex</A></P> Sun, 29 Apr 2012 18:30:21 GMT gkanapathy 2012-04-29T18:30:21Z https://community.splunk.com/t5/Getting-Data-In/Friendly-names-for-source/m-p/39311#M7301 <P>Is it possible to give source friendly names? I collect a bunch of ESXi syslogs from a file and it shows up in splunk as D:\longpath\ipaddress\syslog.log. Because the source name is so long, it gets truncated with ... In the chart legends. I'd like to give it a more meaningful name like 'ESXi-01'.</P> <P>Thanks</P> Sun, 29 Apr 2012 16:38:54 GMT https://community.splunk.com/t5/Getting-Data-In/Friendly-names-for-source/m-p/39311#M7301 virtualpony 2012-04-29T16:38:54Z https://community.splunk.com/t5/Getting-Data-In/Friendly-names-for-source/m-p/39312#M7302 <P>You can use the <CODE>rename</CODE> attribute in the source type stanza in your <CODE>props.conf</CODE> file. See <A href="http://docs.splunk.com/Documentation/Splunk/latest/Data/Renamesourcetypes">Rename source types</A> in the Getting Data In Manual.</P> Sun, 29 Apr 2012 17:14:10 GMT https://community.splunk.com/t5/Getting-Data-In/Friendly-names-for-source/m-p/39312#M7302 ChrisG 2012-04-29T17:14:10Z https://community.splunk.com/t5/Getting-Data-In/Friendly-names-for-source/m-p/39313#M7303 <P>Right idea, but <CODE>rename</CODE> changes the field name, not the field value. you want <CODE>eval</CODE> and one of the <CODE>eval</CODE> functions to change the value, or possibly the <CODE>rex</CODE> command. (Though you do what the <CODE>rex</CODE> command does with <CODE>eval</CODE> using the <CODE>replace()</CODE> function.)</P> Sun, 29 Apr 2012 18:28:58 GMT https://community.splunk.com/t5/Getting-Data-In/Friendly-names-for-source/m-p/39313#M7303 gkanapathy 2012-04-29T18:28:58Z https://community.splunk.com/t5/Getting-Data-In/Friendly-names-for-source/m-p/39314#M7304 <P>Use either the <CODE>eval</CODE> or <CODE>rex</CODE> search commands to modify or create a new field value. See: </P> <P><A href="http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/CommonEvalFunctions">http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/CommonEvalFunctions</A><BR /> <A href="http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Eval">http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Eval</A><BR /> or<BR /> <A href="http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Rex">http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Rex</A></P> Sun, 29 Apr 2012 18:30:21 GMT https://community.splunk.com/t5/Getting-Data-In/Friendly-names-for-source/m-p/39314#M7304 gkanapathy 2012-04-29T18:30:21Z