Can I shorten frequent words?

[BoldKnowsNothin]

Hello comrades,

I'm just curios is there anyway to shorten frequent words?

For example: <Data Name='IpAddress'>::ffff:10.95.81.99</Data>

IpAddress to ipaddr or something like IPa.

Many thanks,

[gcusello]

Hi @BoldKnowsNothin,

did you tried field aliases (https://docs.splunk.com/Documentation/Splunk/9.1.1/Knowledge/Addaliasestofields)?

Ciao.

Giuseppe

[BoldKnowsNothin]

Hello gcusello,

Sir, I just surfed that link you provided to me, many thanks.

But does this field alias reduces space?

Thanks again,

[gcusello]

Hi @BoldKnowsNothin ,

what do you mean with "reduce space"?

alias are applied at search time, meaning there isn't any additional disk usage.

About license usage, the number of aliases or data elaborations don't consume any additional license: license is only the volume of daily indexed logs.

Ciao.

Giuseppe

[inventsekar · Accepted solution]

>>> But does this field alias reduces space?

Do you mean, after doing data onboarding (so the fields are indexed properly), if you apply the field alias, will it reduce the index size?.. 

as per my understanding it wont reduce the index size ( Even if it reduces, it will only reduce very negligible amount only)

[BoldKnowsNothin]

Hello inventsekar,

Sir, all this only for reduce our license usage, currently we afraid to exclude logs, and looking something else to reduce.

Many thanks,

[gcusello]

Hi @BoldKnowsNothin ,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated by all the contributors 😉

[inventsekar]

Hi @BoldKnowsNothin ... ya, i got it.. please note that, for the field names will not occupy lot of space. 

lets say, you have a CSV file with three fields

field1,field2,field3longName
data1,data2,data3

and then you have ten thousand data/records in that CSV file. 

now, the field3 is named as "field3longName"... even if you use alias, the indexer will store it only once. 

but, for license usage... you can analyze these 3 fields and if you dont want, lets say field2, .. then you can totally ignore the field2 while data onboarding. this will save lot of license. 

hope you understood, thanks.