Developing for Splunk Enterprise

is it possible to change the field name after index

New Member

i have a field have space . e.g "product name"
and i found out that if i want to add the field in pivot , which is not allow field name contain space

How can I rename all field in that index from "product name" to "productname"


Tags (1)
0 Karma


Hi @kennethyeung

You can also achieve the same using FIELDALIAS in props.conf. So you can access productname without renaming in every search.

FIELDALIAS-productname =  "product name" AS productname


0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!


Or Learn More in Our Blog >>