Splunk Enterprise Security

How to rename a field when an event indexed?

rendie
Path Finder

Hello,

I have data with fields kind of "Field Id", "Second Id". And I wanna merge these two fields into one, but when I make EVAL-sourcetype = "Field Id"+"Second Id" as a result I get merge fields name but not value.

Also, I used this configuration in props.conf, but without success

[.stanza.]
FIELDALIAS-extract_fieldId
 = "Field Id" as FieldID
FIELDALIAS-extract_secondId = "Second Id" as SecondID
EVAL-sourcetype =FieldID+SecondID
Labels (2)
0 Karma

scelikok
SplunkTrust
SplunkTrust

Hi @rendie,

Can you please provide more information about your need? Do you want to set sourcetype at index time?

 

If this reply helps you an upvote and "Accept as Solution" is appreciated.
0 Karma

rendie
Path Finder

This solution doesn't work for me

0 Karma

scelikok
SplunkTrust
SplunkTrust

Hi @rendie ,

Please try below;

EVAL-sourcetype=FieldID.SecondID

 

If this reply helps you an upvote is appreciated.

If this reply helps you an upvote and "Accept as Solution" is appreciated.
0 Karma

rendie
Path Finder

I tried. it doesn't work for me. Field sourcetype is not created.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...