Getting Data In

Normalize feed before indexing

Anto
Explorer

Is possible to rename values of feeds? i am going to explain it better:

I have open source feeds but some values of them are written in different form, for example, i am going to group all malware names under the same field but i have this trouble:

Malware Name

NjRat command & control
NjRat
Njrat
NJraat
Njratt c&c

 

Is possible to modify them at indexing time under the same name NjRat so when i am going to analyze it i have no problem and they are all grouped? 

Thanks in advance

Labels (3)
0 Karma
Get Updates on the Splunk Community!

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  🚀 Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Feel the Splunk Love: Real Stories from Real Customers

Hello Splunk Community,    What’s the best part of hearing how our customers use Splunk? Easy: the positive ...

Data Management Digest – November 2025

  Welcome to the inaugural edition of Data Management Digest! As your trusted partner in data innovation, the ...