In the following thread we extracted the name value pairs from the embedded json document - [How can we extract a json document within an event?][1]
[1]: https://answers.splunk.com/answers/581928/how-can-we-extract-a-json-document-within-an-event.html
.We would like to rename some of these fields. Where can we do that?
↧