I have indexed few sample logs in to the Splunk..
2020-02-15T10:41:54.305Z servername.com sev="INFO" msg_details="Audit success" pol_name="policy_name"
Splunk by default extract the fields sev, msg_details, pol_name and extract the values appropriately. Everything loos good.
For me, i need to rename the field as severity instead of sev, Description instead of msg_details and Policies instead of pol_name.
I have updated the props.conf
[sourcetype]
FIELDALIAS-severity = sev AS Severity
FIELDALIAS-msg_details = msg_details AS Description
FIELDALIAS-pol_name = pol_name AS Policies
Fields are extracting properly.
When i run the search on Verbose Mode, i can see both sev and Severity, which is quiet annoying for the Analysts
Is it normal or do i have to write a EXTRACT function with appropriate REGEX in order to show only the Severity field NOT sev.
Hi @cyber_castle,
Yes it's normal:
the only way to avoid to have both the field names is to insert a rename in all your searches.
Ciao.
Giuseppe
Hi @cyber_castle,
Yes it's normal:
the only way to avoid to have both the field names is to insert a rename in all your searches.
Ciao.
Giuseppe
Thanks a lot for your prompt response.