is it possible to change the field name after index

[kennethyeung]

i have a field have space . e.g "product name"
and i found out that if i want to add the field in pivot , which is not allow field name contain space

How can I rename all field in that index from "product name" to "productname"

Thanks

[kamlesh_vaghela]

Hi @kennethyeung

You can also achieve the same using FIELDALIAS in props.conf. So you can access productname without renaming in every search.

FIELDALIAS-productname =  "product name" AS productname

https://docs.splunk.com/Documentation/Splunk/7.0.2/Admin/Propsconf#Sourcetype_Category_and_Descripti...

https://docs.splunk.com/Documentation/Splunk/7.0.2/Knowledge/Addaliasestofields

Thanks