Splunk Enterprise Security

How to rename a field when an event indexed?

rendie
Path Finder

Hello,

I have data with fields kind of "Field Id", "Second Id". And I wanna merge these two fields into one, but when I make EVAL-sourcetype = "Field Id"+"Second Id" as a result I get merge fields name but not value.

Also, I used this configuration in props.conf, but without success

[.stanza.]
FIELDALIAS-extract_fieldId
 = "Field Id" as FieldID
FIELDALIAS-extract_secondId = "Second Id" as SecondID
EVAL-sourcetype =FieldID+SecondID
Labels (2)
0 Karma

scelikok
SplunkTrust
SplunkTrust

Hi @rendie,

Can you please provide more information about your need? Do you want to set sourcetype at index time?

 

If this reply helps you an upvote and "Accept as Solution" is appreciated.
0 Karma

rendie
Path Finder

This solution doesn't work for me

0 Karma

scelikok
SplunkTrust
SplunkTrust

Hi @rendie ,

Please try below;

EVAL-sourcetype=FieldID.SecondID

 

If this reply helps you an upvote is appreciated.

If this reply helps you an upvote and "Accept as Solution" is appreciated.
0 Karma

rendie
Path Finder

I tried. it doesn't work for me. Field sourcetype is not created.

0 Karma
Get Updates on the Splunk Community!

Splunk Smartness with Brandon Sternfield | Episode 3

Hello and welcome to another episode of "Splunk Smartness," the interview series where we explore the power of ...

Monitoring Postgres with OpenTelemetry

Behind every business-critical application, you’ll find databases. These behind-the-scenes stores power ...

Mastering Synthetic Browser Testing: Pro Tips to Keep Your Web App Running Smoothly

To start, if you're new to synthetic monitoring, I recommend exploring this synthetic monitoring overview. In ...