All Apps and Add-ons

Rename field value from other source

sarumjanuch
Path Finder

Is there any way to rename fields for by getting value from different source?
For example in my log file i have user=100, and i have table or just a text file, where i spcify 100=Jhon Doe. So i can repleace 100 with Jhon Doe in my reports?

0 Karma
1 Solution

yannK
Splunk Employee
Splunk Employee

Its called a lookup, and you need to generate your list first as a csv file. (outputlookup is your friend)
then call the lookup command at search time to to add new fields, or rename fields values..

see http://docs.splunk.com/Documentation/Splunk/6.0/SearchReference/Lookup
http://docs.splunk.com/Documentation/Splunk/6.0/Search/Useexternalfieldlookups

View solution in original post

yannK
Splunk Employee
Splunk Employee

Its called a lookup, and you need to generate your list first as a csv file. (outputlookup is your friend)
then call the lookup command at search time to to add new fields, or rename fields values..

see http://docs.splunk.com/Documentation/Splunk/6.0/SearchReference/Lookup
http://docs.splunk.com/Documentation/Splunk/6.0/Search/Useexternalfieldlookups

View solution in original post

sarumjanuch
Path Finder

Thank you good man.

0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!