Knowledge Management

How to change field alias of 'Host' field to 'Server'?

splunker12er
Motivator

I need a new field in the name 'Server' from the 'host' field.

Tags (2)
0 Karma

strive
Influencer

In your props.conf

[Your Sourcetype]    
FIELDALIAS-Server = host AS Server

strive
Influencer

You can use wildcards. If you want to apply for everything then you can use [default]
[default]
FIELDALIAS-Server = host AS Server

strive
Influencer

Then you need global settings.

Use the [default] stanza to define any global settings.
You can also define global settings outside of any stanza, at the top of the file.

for more details on GLOBAL SETTINGS see the props.conf http://docs.splunk.com/Documentation/Splunk/6.1.2/admin/Propsconf

0 Karma

splunker12er
Motivator

I do need this generic for all sourcetype. Can i use wildcards in stanza name ?

0 Karma
Get Updates on the Splunk Community!

Changes to Splunk Instructor-Led Training Completion Criteria

We’re excited to share an update to our instructor-led training program that enhances the learning experience ...

Stay Connected: Your Guide to January Tech Talks, Office Hours, and Webinars!

❄️ Welcome the new year with our January lineup of Community Office Hours, Tech Talks, and Webinars! 🎉 ...

Preparing your Splunk Environment for OpenSSL3

The Splunk platform will transition to OpenSSL version 3 in a future release. Actions are required to prepare ...