How can I rename fields based on source?

[snorri]

I have data coming in from two different sources wich both contains the same fieldname.
how can I tell them apart in a search.

For example:
source1 have a field named ID and so does source2.
How can I rename the ID from source1 to ID1 and the ID from source2 to ID2?

[gcusello]

HI snorri,
if they are different sourcetype you can set an alias or a calculated field for one of the flows:
[Settings -- Fields -- Field Alias -- New ] setting the alias for that sourcetype.

If you have the same sourcetype you can use the same way using source instead sourcetype.

Bye.
Giuseppe

[cmerriman]

try this:

|eval ID1=if(source="source1",ID,null())
|eval ID2=if(source="source2",ID,null())

you could create an Event Type/Tag for these, so you don't have to keep distinguishing them in each search. Go to Settings>Event types

http://docs.splunk.com/Documentation/Splunk/7.0.0/Knowledge/Abouteventtypes