Getting Data In
Highlighted

SEDCMD to change field name

Path Finder

Hello
i have a log event as
DEBUG 2017.02.06 17:15:35.385: (common.work) Parsed source address, source='10.0.0.2' i want to change the source as src_ip at index time

can any one help me ?

Thanks in advance

0 Karma
Highlighted

Re: SEDCMD to change field name

SplunkTrust
SplunkTrust

Try like this (props.conf on Indexer/heavy forwarder)

[YourSourceType]
...other settings..
SEDCMD-srcip = s/,\s+source=/, src_ip=/g

View solution in original post

0 Karma
Highlighted

Re: SEDCMD to change field name

Influencer
SEDCMD-source = s/, source=/, src_ip=/

Although I think a better option is to use a field alias. Settings -> Fields -> Field aliases

Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.