https://community.splunk.com/t5/Getting-Data-In/Sourctype-and-fix-jason-field-data/m-p/458469#M99449 <P>There is no such thing as an <CODE>automatic rename</CODE> in Splunk. The closes that you can get are <CODE>automatic field aliases</CODE> but these do not support wildcards so you will have to iterate the entire namespaces.</P> Mon, 02 Sep 2019 01:35:24 GMT woodcock 2019-09-02T01:35:24Z https://community.splunk.com/t5/Getting-Data-In/Sourctype-and-fix-jason-field-data/m-p/458467#M99447 <P>when i run below search its extracting data from AWS bucket so how ican convert this to search time in splunk cloud add to permanently.</P> <PRE><CODE>index=test "aws.guardduty" | rename "BodyJson.detail."* as "detail."* | rename "BodyJson."* as ""* </CODE></PRE> Wed, 21 Aug 2019 19:58:07 GMT https://community.splunk.com/t5/Getting-Data-In/Sourctype-and-fix-jason-field-data/m-p/458467#M99447 Splunk_rocks 2019-08-21T19:58:07Z https://community.splunk.com/t5/Getting-Data-In/Sourctype-and-fix-jason-field-data/m-p/458468#M99448 <P>hmm care to elaborate with an example, if possible?</P> Wed, 21 Aug 2019 20:09:16 GMT https://community.splunk.com/t5/Getting-Data-In/Sourctype-and-fix-jason-field-data/m-p/458468#M99448 Sukisen1981 2019-08-21T20:09:16Z https://community.splunk.com/t5/Getting-Data-In/Sourctype-and-fix-jason-field-data/m-p/458469#M99449 <P>There is no such thing as an <CODE>automatic rename</CODE> in Splunk. The closes that you can get are <CODE>automatic field aliases</CODE> but these do not support wildcards so you will have to iterate the entire namespaces.</P> Mon, 02 Sep 2019 01:35:24 GMT https://community.splunk.com/t5/Getting-Data-In/Sourctype-and-fix-jason-field-data/m-p/458469#M99449 woodcock 2019-09-02T01:35:24Z