Knowledge Management

How to change field alias of 'Host' field to 'Server'?

splunker12er
Motivator

I need a new field in the name 'Server' from the 'host' field.

Tags (2)
0 Karma

strive
Influencer

In your props.conf

[Your Sourcetype]    
FIELDALIAS-Server = host AS Server

strive
Influencer

You can use wildcards. If you want to apply for everything then you can use [default]
[default]
FIELDALIAS-Server = host AS Server

strive
Influencer

Then you need global settings.

Use the [default] stanza to define any global settings.
You can also define global settings outside of any stanza, at the top of the file.

for more details on GLOBAL SETTINGS see the props.conf http://docs.splunk.com/Documentation/Splunk/6.1.2/admin/Propsconf

0 Karma

splunker12er
Motivator

I do need this generic for all sourcetype. Can i use wildcards in stanza name ?

0 Karma
Get Updates on the Splunk Community!

Best Strategies to Optimize Observability Costs

 Join us on Tuesday, May 6, 2025, at 11 AM PDT / 2 PM EDT for an insightful session on optimizing ...

Fueling your curiosity with new Splunk ILT and eLearning courses

At Splunk Education, we’re driven by curiosity—both ours and yours! That’s why we’re committed to delivering ...

Splunk AI Assistant for SPL 1.1.0 | Now Personalized to Your Environment for Greater ...

Splunk AI Assistant for SPL has transformed how users interact with Splunk, making it easier than ever to ...