How can I create a field extraction to modify a key in a key value pair? I have a new file that I am indexing. The key is using "source" and this is conflicting with the built in "source" in Splunk. Making this change when the file is getting indexed will not work in this situation. I am looking to do this at Search Time.
2014-07-23 09:59:56,996 || Thread=9 || channel=CONTACTVIEW || endTimeRaw=1406123991420 || duration=3786 || startTimeRaw=1406123987634 || source=Portfolio || endTime=2014-07-23T13:59:51.420Z
you can extract value "Portfolio" with different field name using rex command or in the props.conf directly.
your base search | rex " source=(?<orig_source>w+)"
you can put the same regex in props.conf.
[YourSourcetype] ...other settings... EXTRACT-orig_group = (?i) source=(?<orig_source>w+)