Change field names of indexed data

[JeremyHagan]

Hi,
I've got a particular source type which I would like to modify the field names of so that they are CIM compliant. Eg rename source_ip to src_ip.

The field names are specified in the tranforms.conf. I am assuming that these field extractions are just search time and aren't written into the index. Is this correct? Will the field name change be reflected against data already indexed?

Cheers,
Jeremy.

[woodcock]

It depends. If you use REPORT- or EXTRACT- in props.conf, then the referenced extractions inside of transforms.conf happen at search-time, but if you call TRANSFORMS-, then they will happen at index-time. Read all about it here:

http://docs.splunk.com/Documentation/Splunk/6.2.5/admin/propsconf
http://docs.splunk.com/Documentation/Splunk/6.2.5/admin/transformsconf

[JeremyHagan]

Good answer. Thanks. We are using REPORT-, so it is all good.

[woodcock]

If you are all set then you should click Accept to close the question.

[esix_splunk]

Once data is indexed, it is not changeable. You can only transform it ( field alias, extractions, etc) at search time. So you are correct.

Cheers
Eric