How to hardcode a field rename

[kwanx]

Hello - didn't see this discussed elsewhere.

I have an SNMP based source type who is interpreting the fields as unfriendly iso numbers (such as iso_3_6_1_4_1_8248_1_1_1_1_1_2)

I am familiar with how to use rename command inside of query.

What i seek is to change a config file (or open to suggestions) to always show iso_3_6_1_4_1_8248_1_1_1_1_1_2 as SERVICE.

If anyway possible, help appreciated!

[lguinn2 · Accepted solution]

Under Settings->Field, you can set a field alias. These are quite simple to set up.

[kwanx]

Thats pretty sweet! not sure how i missed that...thank you!

[somesoni2]

More details here http://docs.splunk.com/Documentation/Splunk/6.2.0/Knowledge/Addaliasestofields