Splunk Search

Datamodel field rename

Nawab
Path Finder

We ingested some data from one device which is not add to network traffic datamodel by default. this device sends data in json format.

data is added to datamodel but when i use auto extracted fields and rename that field to already existed field it is still showing original name in interesting fields.

 

source field = data.clientaddr

dest field = src_ip

 

why i need this to be changed at source level because i want one search to work for all devices.

I am using tstats command in search

 

in interesting fields it is still showing data.clientaddr instead of src_ip

Labels (2)
0 Karma

Nawab
Path Finder

so as i said we are using datamodel with tstats and as tstat we have to use by clause and fields like All_Traffic.src_ip so if the field is not converted before this by clause it can not be used afterwards.

what i did instead, rename the field in data model and using field alies i changed the name to this field.

now we can use src_ip instead of data.clientaddr in any search without renaming it. obviously rename command is more hassel free, but as we all know a permenant solution is what evenyone needs

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Nawab ,

you have two solutions:

  • add new fields to you Data Model, I don't like this solution:
  • rename your fields to insert them in the DM fields, this is the prefereable solution.

in this way, you can use the DM fields for your searches with tstats.

This aliases should be visible both in DMs and in original data, how do you renamed them: in the DM or in the add-on.

Do it in the add-on, so you can see them in intersting fields.

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...