indexing fields

[ahrefai]

Hi all,
I'm new to Splunk and I would like to know how to change indexing fields which Spluck automaticly assigned (i.e. rename the field, remove or add). I really appreciate some directions
Thanks,
Alrifai

[ahrefai]

I mean my database has more actual fields than I have had in the splunked one (columns)

[pradeepkumarg]

You can specify fields in your props.conf file

# The following stanza extracts an ip address from _raw
[my_sourcetype]
EXTRACT-extract_ip = (?\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})

Here is the documentation link

http://docs.splunk.com/Documentation/Splunk/6.0/admin/Propsconf

[ahrefai]

Thanks alot..A good starting point

[lukejadamec]

Which fields?
In most cases it is a better idea to make automatic search time changes.