Add a new field at index time and rewrite values from another field

[saadmalik83]

Hi All,

I am facing an issue with logs from juniper SRX and ES. I am pretty new to splunk, i am hoping the answer would be an easy one to this.

I have a field called protocol-id with numeric values for the protocols e.g. 1,6,17 which are actually ICMP, TCP and UDP respectively. ES doesn't recognize the numeric values and in the ports and protocol dashboard.

I did the following but it's not working:

1. Created a csv with field "id, transport" which would correlate the numeric values to their respective protocols e.g 1-icmp, 6-tcp etc
2. Imported the csv in "lookup table files" and created the "lookup definitions"
3. Created Automatic lookup with source=juniper and Lookup input field "protocol_id" and Lookup output field as "transport"
4. All of this was done on the heavy forwarder, since i want this field to be populated at the forwarder or the index level before it reaches the ES.

Please let me know if this is the correct way or should i use another strategy.

Thanks!

[sundareshr]

If you can uniquely id the field/value. you could use SEDCMD replace the values

http://docs.splunk.com/Documentation/Splunk/6.4.3/Data/Anonymizedata#Anonymize_data_through_a_sed_sc...