Splunk Search

Props config is not taking effect, trying to rename fields



I am trying to rename some fields pre-index using props.conf and it's not working.  Props below.

EVAL-app_name = app
EVAL-src_ip = ipaddr

Also tried using FIELDALIAS to no avail.  The props file is  local  dir on the HF (/opt/splunk/etc/apps/splunk_ta_onelogin/local).  

bt debug shows the intended config ..

/opt/splunk/etc/apps/splunk_ta_onelogin/local/props.conf [onelogin:event]
/opt/splunk/etc/apps/splunk_ta_onelogin/local/props.conf EVAL-app_name = app
/opt/splunk/etc/apps/splunk_ta_onelogin/local/props.conf EVAL-src_ip = ipaddr

Also tried putting the props file in system local, no effect.  How do I troubleshoot this?  Thanks!


Labels (1)
0 Karma


Did you cycle Splunk after making changes?

An upvote would be appreciated and Accept Solution if it helps!
0 Karma


Hi @oleg106 

EVAL, FIELDALIAS are works during search-time hence they shall be deployed to SearchHead not HF.


An upvote would be appreciated and Accept solution if this reply helps!

Tags (2)
0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...