Splunk Search

How to map certain extracted interesting fields to a name to use these fields in a data model?

jflaherty
Path Finder

Hello,

I have a couple of sources that Splunk is nicely automatically pulling the fields I need into the "Interesting Fields". One is active directory and other is a json. The problem is that I need to use these fields in a data model, but they are not named the same. Is there a way to map these fields to a name so I don't have to manually create an extraction for each? If not, is there anywhere I can see what regexes Splunk is using to extract the fields so I can make sure I get them right?

Thanks!

0 Karma
1 Solution

niketn
Legend

You can use Field Aliases knowledge Objects provided in Splunk. Refer to the following documentation:

http://docs.splunk.com/Documentation/Splunk/6.5.1/Knowledge/Addaliasestofields

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

niketn
Legend

You can use Field Aliases knowledge Objects provided in Splunk. Refer to the following documentation:

http://docs.splunk.com/Documentation/Splunk/6.5.1/Knowledge/Addaliasestofields

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...