Getting Data In

Change field names of indexed data

JeremyHagan
Communicator

Hi,
I've got a particular source type which I would like to modify the field names of so that they are CIM compliant. Eg rename source_ip to src_ip.

The field names are specified in the tranforms.conf. I am assuming that these field extractions are just search time and aren't written into the index. Is this correct? Will the field name change be reflected against data already indexed?

Cheers,
Jeremy.

0 Karma

woodcock
Esteemed Legend

It depends. If you use REPORT- or EXTRACT- in props.conf, then the referenced extractions inside of transforms.conf happen at search-time, but if you call TRANSFORMS-, then they will happen at index-time. Read all about it here:

http://docs.splunk.com/Documentation/Splunk/6.2.5/admin/propsconf
http://docs.splunk.com/Documentation/Splunk/6.2.5/admin/transformsconf

JeremyHagan
Communicator

Good answer. Thanks. We are using REPORT-, so it is all good.

0 Karma

woodcock
Esteemed Legend

If you are all set then you should click Accept to close the question.

0 Karma

esix_splunk
Splunk Employee
Splunk Employee

Once data is indexed, it is not changeable. You can only transform it ( field alias, extractions, etc) at search time. So you are correct.

Cheers
Eric

0 Karma
Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...