Knowledge Management

How to change field alias of 'Host' field to 'Server'?

splunker12er
Motivator

I need a new field in the name 'Server' from the 'host' field.

Tags (2)
0 Karma

strive
Influencer

In your props.conf

[Your Sourcetype]    
FIELDALIAS-Server = host AS Server

strive
Influencer

You can use wildcards. If you want to apply for everything then you can use [default]
[default]
FIELDALIAS-Server = host AS Server

strive
Influencer

Then you need global settings.

Use the [default] stanza to define any global settings.
You can also define global settings outside of any stanza, at the top of the file.

for more details on GLOBAL SETTINGS see the props.conf http://docs.splunk.com/Documentation/Splunk/6.1.2/admin/Propsconf

0 Karma

splunker12er
Motivator

I do need this generic for all sourcetype. Can i use wildcards in stanza name ?

0 Karma
Get Updates on the Splunk Community!

Splunk APM & RUM | Upcoming Planned Maintenance

There will be planned maintenance of Splunk APM’s and Splunk RUM’s streaming infrastructure in the coming ...

Part 2: Diving Deeper With AIOps

Getting the Most Out of Event Correlation and Alert Storm Detection in Splunk IT Service Intelligence   Watch ...

User Groups | Upcoming Events!

If by chance you weren't already aware, the Splunk Community is host to numerous User Groups, organized ...