i have a field have space . e.g "product name"
and i found out that if i want to add the field in pivot , which is not allow field name contain space
How can I rename all field in that index from "product name" to "productname"
Thanks
Hi @kennethyeung
You can also achieve the same using FIELDALIAS
in props.conf
. So you can access productname
without renaming in every search.
FIELDALIAS-productname = "product name" AS productname
https://docs.splunk.com/Documentation/Splunk/7.0.2/Knowledge/Addaliasestofields
Thanks