https://community.splunk.com/t5/Splunk-Search/indexing-fields/m-p/152250#M42685 <P>You can specify fields in your props.conf file</P> <PRE> # The following stanza extracts an ip address from _raw [my_sourcetype] EXTRACT-extract_ip = (?<IP>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}) </IP></PRE> <P>Here is the documentation link<BR /> <PRE><BR /> <A href="http://docs.splunk.com/Documentation/Splunk/6.0/admin/Propsconf">http://docs.splunk.com/Documentation/Splunk/6.0/admin/Propsconf</A><BR /> </PRE></P> Fri, 22 Nov 2013 14:52:06 GMT pradeepkumarg 2013-11-22T14:52:06Z https://community.splunk.com/t5/Splunk-Search/indexing-fields/m-p/152248#M42683 <P>Hi all,<BR /> I'm new to Splunk and I would like to know how to change indexing fields which Spluck automaticly assigned (i.e. rename the field, remove or add). I really appreciate some directions<BR /> Thanks,<BR /> Alrifai</P> Fri, 22 Nov 2013 13:47:16 GMT https://community.splunk.com/t5/Splunk-Search/indexing-fields/m-p/152248#M42683 ahrefai 2013-11-22T13:47:16Z https://community.splunk.com/t5/Splunk-Search/indexing-fields/m-p/152249#M42684 <P>Which fields?<BR /> In most cases it is a better idea to make automatic search time changes.</P> Fri, 22 Nov 2013 14:46:31 GMT https://community.splunk.com/t5/Splunk-Search/indexing-fields/m-p/152249#M42684 lukejadamec 2013-11-22T14:46:31Z https://community.splunk.com/t5/Splunk-Search/indexing-fields/m-p/152250#M42685 <P>You can specify fields in your props.conf file</P> <PRE> # The following stanza extracts an ip address from _raw [my_sourcetype] EXTRACT-extract_ip = (?<IP>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}) </IP></PRE> <P>Here is the documentation link<BR /> <PRE><BR /> <A href="http://docs.splunk.com/Documentation/Splunk/6.0/admin/Propsconf">http://docs.splunk.com/Documentation/Splunk/6.0/admin/Propsconf</A><BR /> </PRE></P> Fri, 22 Nov 2013 14:52:06 GMT https://community.splunk.com/t5/Splunk-Search/indexing-fields/m-p/152250#M42685 pradeepkumarg 2013-11-22T14:52:06Z https://community.splunk.com/t5/Splunk-Search/indexing-fields/m-p/152251#M42686 <P>Thanks alot..A good starting point</P> Fri, 22 Nov 2013 15:11:34 GMT https://community.splunk.com/t5/Splunk-Search/indexing-fields/m-p/152251#M42686 ahrefai 2013-11-22T15:11:34Z https://community.splunk.com/t5/Splunk-Search/indexing-fields/m-p/152252#M42687 <P>I mean my database has more actual fields than I have had in the splunked one (columns)</P> Fri, 22 Nov 2013 15:14:41 GMT https://community.splunk.com/t5/Splunk-Search/indexing-fields/m-p/152252#M42687 ahrefai 2013-11-22T15:14:41Z