Is it possible to give source friendly names? I collect a bunch of ESXi syslogs from a file and it shows up in splunk as D:\longpath\ipaddress\syslog.log. Because the source name is so long, it gets truncated with ... In the chart legends. I'd like to give it a more meaningful name like 'ESXi-01'.
Thanks
Use either the eval
or rex
search commands to modify or create a new field value. See:
http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/CommonEvalFunctions
http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Eval
or
http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Rex
You can use the rename
attribute in the source type stanza in your props.conf
file. See Rename source types in the Getting Data In Manual.
Right idea, but rename
changes the field name, not the field value. you want eval
and one of the eval
functions to change the value, or possibly the rex
command. (Though you do what the rex
command does with eval
using the replace()
function.)