Knowledge Management

How to change field alias of 'Host' field to 'Server'?

splunker12er
Motivator

I need a new field in the name 'Server' from the 'host' field.

Tags (2)
0 Karma

strive
Influencer

In your props.conf

[Your Sourcetype]    
FIELDALIAS-Server = host AS Server

strive
Influencer

You can use wildcards. If you want to apply for everything then you can use [default]
[default]
FIELDALIAS-Server = host AS Server

strive
Influencer

Then you need global settings.

Use the [default] stanza to define any global settings.
You can also define global settings outside of any stanza, at the top of the file.

for more details on GLOBAL SETTINGS see the props.conf http://docs.splunk.com/Documentation/Splunk/6.1.2/admin/Propsconf

0 Karma

splunker12er
Motivator

I do need this generic for all sourcetype. Can i use wildcards in stanza name ?

0 Karma
Get Updates on the Splunk Community!

Harnessing Splunk’s Federated Search for Amazon S3

Managing your data effectively often means balancing performance, costs, and compliance. Splunk’s Federated ...

Infographic provides the TL;DR for the 2024 Splunk Career Impact Report

We’ve been buzzing with excitement about the recent validation of Splunk Education! The 2024 Splunk Career ...

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...