Splunk Search

indexing fields

ahrefai
Engager

Hi all,
I'm new to Splunk and I would like to know how to change indexing fields which Spluck automaticly assigned (i.e. rename the field, remove or add). I really appreciate some directions
Thanks,
Alrifai

Tags (1)
0 Karma

ahrefai
Engager

I mean my database has more actual fields than I have had in the splunked one (columns)

0 Karma

pradeepkumarg
Influencer

You can specify fields in your props.conf file

# The following stanza extracts an ip address from _raw
[my_sourcetype]
EXTRACT-extract_ip = (?\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})

Here is the documentation link


http://docs.splunk.com/Documentation/Splunk/6.0/admin/Propsconf

ahrefai
Engager

Thanks alot..A good starting point

0 Karma

lukejadamec
Super Champion

Which fields?
In most cases it is a better idea to make automatic search time changes.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...