Getting Data In

Replace field at index time

Path Finder


I would like to replace the "action" field so it conforms with the CIM datamodel.
action at present will alway equal either "Successful" or "error".
I would like to replace "Successful" to "success" and "error" to "failure".

For example
Current fields


After field replacement


Thank you

0 Karma


You might explore creating a field alias for those fields under settings > fields > field alias

Splunk references field aliases as a first step under "Make your fields CIM-compliant" in the Common Information Model Add-on Manual. There are step by step instructions for various tasks:

Also, search time field extractions are recommended over index time:

0 Karma
Get Updates on the Splunk Community!

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...

New Learning Videos on Topics Most Requested by You! Plus This Month’s New Splunk ...

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

How I Instrumented a Rust Application Without Knowing Rust

As a technical writer, I often have to edit or create code snippets for Splunk's distributions of ...