Knowledge Management

How to change field alias of 'Host' field to 'Server'?

splunker12er
Motivator

I need a new field in the name 'Server' from the 'host' field.

Tags (2)
0 Karma

strive
Influencer

In your props.conf

[Your Sourcetype]    
FIELDALIAS-Server = host AS Server

strive
Influencer

You can use wildcards. If you want to apply for everything then you can use [default]
[default]
FIELDALIAS-Server = host AS Server

strive
Influencer

Then you need global settings.

Use the [default] stanza to define any global settings.
You can also define global settings outside of any stanza, at the top of the file.

for more details on GLOBAL SETTINGS see the props.conf http://docs.splunk.com/Documentation/Splunk/6.1.2/admin/Propsconf

0 Karma

splunker12er
Motivator

I do need this generic for all sourcetype. Can i use wildcards in stanza name ?

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...