Getting Data In

Can we rename fields in transforms.conf?

ddrillic
Ultra Champion

In the following thread we extracted the name value pairs from the embedded json document - How can we extract a json document within an event?

.We would like to rename some of these fields. Where can we do that?

1 Solution

skoelpin
SplunkTrust
SplunkTrust

You could always create an alias for the existing fields. Removing and renaming fields may be difficult if you have a lot of data in there

https://docs.splunk.com/Documentation/Splunk/7.0.0/Knowledge/Addaliasestofields

View solution in original post

0 Karma

skoelpin
SplunkTrust
SplunkTrust

You could always create an alias for the existing fields. Removing and renaming fields may be difficult if you have a lot of data in there

https://docs.splunk.com/Documentation/Splunk/7.0.0/Knowledge/Addaliasestofields

View solution in original post

0 Karma

ddrillic
Ultra Champion

Perfect @skoelpin - the alias solution makes sense.

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!