Renaming fields in transforms.conf

[adrianathome]

Hello,
I was wondering what would be the impact of renaming fields that have been defined in transforms.conf. More specifically, what happens to data that has already been indexed with the old field names.

Thanks!

[adrianathome · Accepted solution]

No impact. The fields applied to all the data that was previously indexed. Thanks sdaniels.

[sdaniels]

Are you just renaming some fields where you were using DELIMS or something like that? Splunk allows you to do this at search time so if you change the name, restart Splunk, it will be applied to all of the historical data as well as new data coming in. Keep in mind this could affect any saved searches that already use a particular field name.