Developing for Splunk Enterprise

is it possible to change the field name after index

kennethyeung
New Member

i have a field have space . e.g "product name"
and i found out that if i want to add the field in pivot , which is not allow field name contain space

How can I rename all field in that index from "product name" to "productname"

Thanks

Tags (1)
0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

Hi @kennethyeung

You can also achieve the same using FIELDALIAS in props.conf. So you can access productname without renaming in every search.

FIELDALIAS-productname =  "product name" AS productname

https://docs.splunk.com/Documentation/Splunk/7.0.2/Admin/Propsconf#Sourcetype_Category_and_Descripti...

https://docs.splunk.com/Documentation/Splunk/7.0.2/Knowledge/Addaliasestofields

Thanks

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!