- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
How to change field alias of 'Host' field to 'Server'?

splunker12er
Motivator
08-13-2014
02:17 AM
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

strive
Influencer
08-13-2014
02:27 AM
In your props.conf
[Your Sourcetype]
FIELDALIAS-Server = host AS Server
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

strive
Influencer
08-13-2014
11:02 AM
You can use wildcards. If you want to apply for everything then you can use [default]
[default]
FIELDALIAS-Server = host AS Server
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

strive
Influencer
08-13-2014
04:04 AM
Then you need global settings.
Use the [default] stanza to define any global settings.
You can also define global settings outside of any stanza, at the top of the file.
for more details on GLOBAL SETTINGS see the props.conf http://docs.splunk.com/Documentation/Splunk/6.1.2/admin/Propsconf
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

splunker12er
Motivator
08-13-2014
02:29 AM
I do need this generic for all sourcetype. Can i use wildcards in stanza name ?
