Hi all,
I'm new to Splunk and I would like to know how to change indexing fields which Spluck automaticly assigned (i.e. rename the field, remove or add). I really appreciate some directions
Thanks,
Alrifai
I mean my database has more actual fields than I have had in the splunked one (columns)
You can specify fields in your props.conf file
# The following stanza extracts an ip address from _raw [my_sourcetype] EXTRACT-extract_ip = (?\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})
Here is the documentation link
http://docs.splunk.com/Documentation/Splunk/6.0/admin/Propsconf
Thanks alot..A good starting point
Which fields?
In most cases it is a better idea to make automatic search time changes.