Splunk Search

How to hardcode a field rename

kwanx
Explorer

Hello - didn't see this discussed elsewhere.

I have an SNMP based source type who is interpreting the fields as unfriendly iso numbers (such as iso_3_6_1_4_1_8248_1_1_1_1_1_2)

I am familiar with how to use rename command inside of query.

What i seek is to change a config file (or open to suggestions) to always show iso_3_6_1_4_1_8248_1_1_1_1_1_2 as SERVICE.

If anyway possible, help appreciated!

Tags (2)
0 Karma
1 Solution

lguinn2
Legend

Under Settings->Field, you can set a field alias. These are quite simple to set up.

View solution in original post

lguinn2
Legend

Under Settings->Field, you can set a field alias. These are quite simple to set up.

kwanx
Explorer

Thats pretty sweet! not sure how i missed that...thank you!

0 Karma

somesoni2
Revered Legend
0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...