topic How can I rename fields based on source? in Knowledge Management

How can I rename fields based on source?

snorri — Mon, 23 Oct 2017 11:47:28 GMT

I have data coming in from two different sources wich both contains the same fieldname.
how can I tell them apart in a search.

For example:
source1 have a field named ID and so does source2.
How can I rename the ID from source1 to ID1 and the ID from source2 to ID2?

Re: How can I rename fields based on source?

cmerriman — Mon, 23 Oct 2017 12:29:32 GMT

try this:

|eval ID1=if(source="source1",ID,null())
|eval ID2=if(source="source2",ID,null())

you could create an Event Type/Tag for these, so you don't have to keep distinguishing them in each search. Go to Settings>Event types

http://docs.splunk.com/Documentation/Splunk/7.0.0/Knowledge/Abouteventtypes

Re: How can I rename fields based on source?

gcusello — Mon, 23 Oct 2017 12:34:36 GMT

HI snorri,
if they are different sourcetype you can set an alias or a calculated field for one of the flows:
[Settings -- Fields -- Field Alias -- New ] setting the alias for that sourcetype.

If you have the same sourcetype you can use the same way using source instead sourcetype.

Bye.
Giuseppe