Renaming fields after transform.conf regex

arrowecssupport — Tue, 03 Jul 2018 14:24:50 GMT

We use a transform.conf file with regex to extract the field values. However, the field name in the data input is not in human-readable format. But each value is predictable and we have a reference csv that would allow us to correlate these data together.

uadhshuasdfiuh = Server1
xcoijcxvboijcxvb = Server2

These fields are created on the fly and there are hundreds of them. My question is how would automatically rename these fields, to be more usable in the Splunk ui?

Re: Renaming fields after transform.conf regex

493669 — Tue, 03 Jul 2018 14:48:05 GMT

use FIELDALIAS in props.conf-

FIELDALIAS-<class> = (<orig_field_name> AS <new_field_name>)

Use this to apply aliases to a field. The original field is not removed. This just means that the original field can be searched on using any of its aliases.
You can create multiple aliases for the same field.
<orig_field_name> is the original name of the field.
<new_field_name> is the alias to assign to the field.
You can include multiple field alias renames in the same stanza.
Field aliasing is performed at search time, after field extraction, but before calculated fields (EVAL-* statements) and lookups. This means that: * Any field extracted at search time can be aliased. * You can specify a lookup based on a field alias. * You cannot alias a calculated field.

topic Renaming fields after transform.conf regex in Knowledge Management

Renaming fields after transform.conf regex

Re: Renaming fields after transform.conf regex