Splunk Search

indexing fields

Engager

Hi all,
I'm new to Splunk and I would like to know how to change indexing fields which Spluck automaticly assigned (i.e. rename the field, remove or add). I really appreciate some directions
Thanks,
Alrifai

Tags (1)
0 Karma

Engager

I mean my database has more actual fields than I have had in the splunked one (columns)

0 Karma

Influencer

You can specify fields in your props.conf file

# The following stanza extracts an ip address from _raw
[my_sourcetype]
EXTRACT-extract_ip = (?\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})

Here is the documentation link


http://docs.splunk.com/Documentation/Splunk/6.0/admin/Propsconf

Engager

Thanks alot..A good starting point

0 Karma

Super Champion

Which fields?
In most cases it is a better idea to make automatic search time changes.

0 Karma