SEDCMD to change field name

[saifuddin9122]

Hello
i have a log event as
DEBUG 2017.02.06 17:15:35.385: (common.work) Parsed source address, source='10.0.0.2' i want to change the source as src_ip at index time

can any one help me ?

Thanks in advance

[twinspop]

SEDCMD-source = s/, source=/, src_ip=/

Although I think a better option is to use a field alias. Settings -> Fields -> Field aliases

[somesoni2 · Accepted solution]

Try like this (props.conf on Indexer/heavy forwarder)

[YourSourceType]
...other settings..
SEDCMD-srcip = s/,\s+source=/, src_ip=/g