Splunk Search

Rename fields in source

Joannna
Explorer

Hello 🙂

 

I have splunk getting data from a folder everyday.

Recently the files changed the name of the fields.

Here is a sample there are 44 fields in total,

Old 	New
Number	number
Correlation ID	correlation_id
Opened	opened_at
Priority	priority
Category	category
Site	u_customer_site
Domain	u_domain
Nature	u_nature

 

I was wondering if there is anyway i can make this change without needing to add to every single dashboard the | rename as 44 times.

 

Labels (6)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Add 44 FIELDALIAS settings in the appropriate props.conf stanza.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Add 44 FIELDALIAS settings in the appropriate props.conf stanza.

---
If this reply helps you, Karma would be appreciated.

ITWhisperer
SplunkTrust
SplunkTrust

You could put the renames in a macro and then call the macro from your dashboards.

Get Updates on the Splunk Community!

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...

Security Highlights | January 2023 Newsletter

January 2023 Splunk Security Essentials (SSE) 3.7.0 ReleaseThe free Splunk Security Essentials (SSE) 3.7.0 app ...

Platform Highlights | January 2023 Newsletter

 January 2023Peace on Earth and Peace of Mind With Business ResilienceAll organizations can start the new year ...