Splunk Search

Datamodel field rename

Nawab
Path Finder

We ingested some data from one device which is not add to network traffic datamodel by default. this device sends data in json format.

data is added to datamodel but when i use auto extracted fields and rename that field to already existed field it is still showing original name in interesting fields.

 

source field = data.clientaddr

dest field = src_ip

 

why i need this to be changed at source level because i want one search to work for all devices.

I am using tstats command in search

 

in interesting fields it is still showing data.clientaddr instead of src_ip

Labels (2)
0 Karma

Nawab
Path Finder

so as i said we are using datamodel with tstats and as tstat we have to use by clause and fields like All_Traffic.src_ip so if the field is not converted before this by clause it can not be used afterwards.

what i did instead, rename the field in data model and using field alies i changed the name to this field.

now we can use src_ip instead of data.clientaddr in any search without renaming it. obviously rename command is more hassel free, but as we all know a permenant solution is what evenyone needs

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Nawab ,

you have two solutions:

  • add new fields to you Data Model, I don't like this solution:
  • rename your fields to insert them in the DM fields, this is the prefereable solution.

in this way, you can use the DM fields for your searches with tstats.

This aliases should be visible both in DMs and in original data, how do you renamed them: in the DM or in the add-on.

Do it in the add-on, so you can see them in intersting fields.

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In January, the Splunk Threat Research Team had one release of new security content via the Splunk ES Content ...

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...