Splunk Enterprise Security

How to rename a field when an event indexed?

rendie
Path Finder

Hello,

I have data with fields kind of "Field Id", "Second Id". And I wanna merge these two fields into one, but when I make EVAL-sourcetype = "Field Id"+"Second Id" as a result I get merge fields name but not value.

Also, I used this configuration in props.conf, but without success

[.stanza.]
FIELDALIAS-extract_fieldId
 = "Field Id" as FieldID
FIELDALIAS-extract_secondId = "Second Id" as SecondID
EVAL-sourcetype =FieldID+SecondID
Labels (2)
0 Karma

scelikok
SplunkTrust
SplunkTrust

Hi @rendie,

Can you please provide more information about your need? Do you want to set sourcetype at index time?

 

If this reply helps you an upvote and "Accept as Solution" is appreciated.
0 Karma

rendie
Path Finder

This solution doesn't work for me

0 Karma

scelikok
SplunkTrust
SplunkTrust

Hi @rendie ,

Please try below;

EVAL-sourcetype=FieldID.SecondID

 

If this reply helps you an upvote is appreciated.

If this reply helps you an upvote and "Accept as Solution" is appreciated.
0 Karma

rendie
Path Finder

I tried. it doesn't work for me. Field sourcetype is not created.

0 Karma
Get Updates on the Splunk Community!

Splunk Classroom Chronicles: Training Tales and Testimonials (Episode 2)

Welcome to the "Splunk Classroom Chronicles" series, created to help curious, career-minded learners get ...

Index This | I am a number but I am countless. What am I?

January 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  Happy New Year! We’re ...

What’s New in Splunk Enterprise 9.4: Tools for Digital Resilience

PLATFORM TECH TALKS What’s New in Splunk Enterprise 9.4: Tools for Digital Resilience Thursday, February 27, ...