Knowledge Management

How can I rename fields based on source?

snorri
Path Finder

I have data coming in from two different sources wich both contains the same fieldname.
how can I tell them apart in a search.

For example:
source1 have a field named ID and so does source2.
How can I rename the ID from source1 to ID1 and the ID from source2 to ID2?

0 Karma

gcusello
SplunkTrust
SplunkTrust

HI snorri,
if they are different sourcetype you can set an alias or a calculated field for one of the flows:
[Settings -- Fields -- Field Alias -- New ] setting the alias for that sourcetype.

If you have the same sourcetype you can use the same way using source instead sourcetype.

Bye.
Giuseppe

0 Karma

cmerriman
Super Champion

try this:

|eval ID1=if(source="source1",ID,null())
|eval ID2=if(source="source2",ID,null())

you could create an Event Type/Tag for these, so you don't have to keep distinguishing them in each search. Go to Settings>Event types

http://docs.splunk.com/Documentation/Splunk/7.0.0/Knowledge/Abouteventtypes

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In January, the Splunk Threat Research Team had one release of new security content via the Splunk ES Content ...

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...