https://community.splunk.com/t5/Getting-Data-In/Normalize-feed-before-indexing/m-p/537015#M90007 <P>Is possible to rename values of feeds? i am going to explain it better:<BR /><BR />I have open source feeds but some values of them are written in different form, for example, i am going to group all malware names under the same field but i have this trouble:<BR /><BR />Malware Name</P><P>NjRat command &amp; control<BR />NjRat<BR />Njrat<BR />NJraat<BR />Njratt c&amp;c</P><P>&nbsp;</P><P>Is possible to modify them at indexing time under the same name NjRat so when i am going to analyze it i have no problem and they are all grouped?&nbsp;</P><P>Thanks in advance</P> Mon, 25 Jan 2021 09:35:01 GMT Anto 2021-01-25T09:35:01Z https://community.splunk.com/t5/Getting-Data-In/Normalize-feed-before-indexing/m-p/537015#M90007 <P>Is possible to rename values of feeds? i am going to explain it better:<BR /><BR />I have open source feeds but some values of them are written in different form, for example, i am going to group all malware names under the same field but i have this trouble:<BR /><BR />Malware Name</P><P>NjRat command &amp; control<BR />NjRat<BR />Njrat<BR />NJraat<BR />Njratt c&amp;c</P><P>&nbsp;</P><P>Is possible to modify them at indexing time under the same name NjRat so when i am going to analyze it i have no problem and they are all grouped?&nbsp;</P><P>Thanks in advance</P> Mon, 25 Jan 2021 09:35:01 GMT https://community.splunk.com/t5/Getting-Data-In/Normalize-feed-before-indexing/m-p/537015#M90007 Anto 2021-01-25T09:35:01Z