Getting Data In

Renaming Fields in Data

defikes
Explorer

Good Morning,

We are having a bit on an issue with our data "layout". In our wineventlogs we have a field in the XML called Parent Process Name but shows up in our events as Creation Process Name. The issue we are having is our correlation searches are using the Parent Process Name to find certain events so this isn't matching up. I am curious the best way to make sure that Parent Process Name field stays named in this setup and not changed to Creation Process Name. I have attempted to turn on the rendered XML in order to have it come over in this format but to no avail. I have also thought about using transfroms and props.conf but not sure where the switch is taking place. 

Field Example:

Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe

The way that data is flowing is UF ----> Heavy Forwarder ------> Splunk Cloud

Field example would be:

0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @defikes,

did you tried to creata an alias on your Search Heads?

for more infos see at https://docs.splunk.com/Documentation/Splunk/8.1.2/Knowledge/Addaliasestofields

Ciao.

Giuseppe

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi @defikes,

did you tried to creata an alias on your Search Heads?

for more infos see at https://docs.splunk.com/Documentation/Splunk/8.1.2/Knowledge/Addaliasestofields

Ciao.

Giuseppe

defikes
Explorer

Thank you for that insight. This appears to have worked

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @defikes,

good for you!

Ciao and happy splunking.

Giuseppe

P.S.: Karma Points are appreciated 😉

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...