Splunk Search

How to hardcode a field rename

kwanx
Explorer

Hello - didn't see this discussed elsewhere.

I have an SNMP based source type who is interpreting the fields as unfriendly iso numbers (such as iso_3_6_1_4_1_8248_1_1_1_1_1_2)

I am familiar with how to use rename command inside of query.

What i seek is to change a config file (or open to suggestions) to always show iso_3_6_1_4_1_8248_1_1_1_1_1_2 as SERVICE.

If anyway possible, help appreciated!

Tags (2)
0 Karma
1 Solution

lguinn2
Legend

Under Settings->Field, you can set a field alias. These are quite simple to set up.

View solution in original post

lguinn2
Legend

Under Settings->Field, you can set a field alias. These are quite simple to set up.

kwanx
Explorer

Thats pretty sweet! not sure how i missed that...thank you!

0 Karma

somesoni2
Revered Legend
0 Karma
Get Updates on the Splunk Community!

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...

Splunk AppDynamics Agents Webinar Series

Mark your calendars! On June 24th at 12PM PST, we’re going live with the second session of our Splunk ...

SplunkTrust Application Period is Officially OPEN!

It's that time, folks! The application/nomination period for the 2025 SplunkTrust is officially open! If you ...