Translate Column values

[michael_lee]

Hi,
Say I have indexed a file that has this structure:

1|A|B
2|C|D

I have a mapping like this :

1="Val1"
2="Val2"

Only the first column need to be translated. Hence when user search for "B", I want to return

Val1|A|B

How can this done?
Thanks

[vganjare · Accepted solution]

HI,

This can be done using Field aliasing. More details @ http://docs.splunk.com/Documentation/Splunk/6.2.3/Knowledge/Addaliasestofields

Thanks!!