How to rename a field when an event indexed?

[rendie]

Hello,

I have data with fields kind of "Field Id", "Second Id". And I wanna merge these two fields into one, but when I make EVAL-sourcetype = "Field Id"+"Second Id" as a result I get merge fields name but not value.

Also, I used this configuration in props.conf, but without success

[.stanza.]
FIELDALIAS-extract_fieldId = "Field Id" as FieldID

FIELDALIAS-extract_secondId = "Second Id" as SecondID

EVAL-sourcetype =FieldID+SecondID

[scelikok]

Hi @rendie,

Can you please provide more information about your need? Do you want to set sourcetype at index time?

[to4kawa]

https://community.splunk.com/t5/Getting-Data-In/transforms-conf-won-t-let-me-change-the-sourcetype/m...

[rendie]

This solution doesn't work for me

[scelikok]

Hi @rendie ,

Please try below;

EVAL-sourcetype=FieldID.SecondID

If this reply helps you an upvote is appreciated.

[rendie]

I tried. it doesn't work for me. Field sourcetype is not created.