Splunk Enterprise Security

How to rename a field when an event indexed?

rendie
Path Finder

Hello,

I have data with fields kind of "Field Id", "Second Id". And I wanna merge these two fields into one, but when I make EVAL-sourcetype = "Field Id"+"Second Id" as a result I get merge fields name but not value.

Also, I used this configuration in props.conf, but without success

[.stanza.]
FIELDALIAS-extract_fieldId
 = "Field Id" as FieldID
FIELDALIAS-extract_secondId = "Second Id" as SecondID
EVAL-sourcetype =FieldID+SecondID
Labels (2)
0 Karma

scelikok
SplunkTrust
SplunkTrust

Hi @rendie,

Can you please provide more information about your need? Do you want to set sourcetype at index time?

 

If this reply helps you an upvote and "Accept as Solution" is appreciated.
0 Karma

rendie
Path Finder

This solution doesn't work for me

0 Karma

scelikok
SplunkTrust
SplunkTrust

Hi @rendie ,

Please try below;

EVAL-sourcetype=FieldID.SecondID

 

If this reply helps you an upvote is appreciated.

If this reply helps you an upvote and "Accept as Solution" is appreciated.
0 Karma

rendie
Path Finder

I tried. it doesn't work for me. Field sourcetype is not created.

0 Karma
Get Updates on the Splunk Community!

Splunk Classroom Chronicles: Training Tales and Testimonials (Episode 3)

Welcome back to Splunk Classroom Chronicles, our ongoing blog series that pulls back the curtain on Splunk ...

Operationalizing TDIR: Building a More Resilient, Scalable SOC

Optimizing SOC workflows with a unified, risk-based approach to Threat Detection, Investigation, and Response ...

Almost Too Eventful Assurance: Part 1

Modern IT and Network teams still struggle with too many alerts and isolating issues before they are notified. ...