Developing for Splunk Enterprise

is it possible to change the field name after index

kennethyeung
New Member

i have a field have space . e.g "product name"
and i found out that if i want to add the field in pivot , which is not allow field name contain space

How can I rename all field in that index from "product name" to "productname"

Thanks

Tags (1)
0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

Hi @kennethyeung

You can also achieve the same using FIELDALIAS in props.conf. So you can access productname without renaming in every search.

FIELDALIAS-productname =  "product name" AS productname

https://docs.splunk.com/Documentation/Splunk/7.0.2/Admin/Propsconf#Sourcetype_Category_and_Descripti...

https://docs.splunk.com/Documentation/Splunk/7.0.2/Knowledge/Addaliasestofields

Thanks

0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>