<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: How to create a FIELDALIAS for a tagged field in Getting Data In</title>
    <link>https://community.splunk.com/t5/Getting-Data-In/How-to-create-a-FIELDALIAS-for-a-tagged-field/m-p/134749#M27711</link>
    <description>&lt;P&gt;tried with normal fields it works. But for tagged fields (tag::fieldname) it doesnt work.&lt;BR /&gt;
Any tricks to make this work ?&lt;/P&gt;</description>
    <pubDate>Thu, 17 Apr 2014 02:28:45 GMT</pubDate>
    <dc:creator>splunker12er</dc:creator>
    <dc:date>2014-04-17T02:28:45Z</dc:date>
    <item>
      <title>How to create a FIELDALIAS for a tagged field</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/How-to-create-a-FIELDALIAS-for-a-tagged-field/m-p/134748#M27710</link>
      <description>&lt;P&gt;I do have differnet host servers(db,php,widnows)&lt;/P&gt;

&lt;P&gt;I tagged each "&lt;CODE&gt;host&lt;/CODE&gt;" field into "&lt;CODE&gt;db_server&lt;/CODE&gt;" "&lt;CODE&gt;php_server&lt;/CODE&gt;" "&lt;CODE&gt;win_server&lt;/CODE&gt;"&lt;/P&gt;

&lt;P&gt;I also tried to create a &lt;CODE&gt;field alias&lt;/CODE&gt; for the tagged field "tag::host" as Host_Name, but that doesnt create a FIELDALIAS. Any mistake did i made here? please help&lt;/P&gt;

&lt;P&gt;&lt;STRONG&gt;My configs:&lt;/STRONG&gt;&lt;/P&gt;

&lt;P&gt;&lt;U&gt;tag.conf&lt;/U&gt;&lt;BR /&gt;&lt;BR /&gt;
[host=10.250.200.6]&lt;BR /&gt;&lt;BR /&gt;
database_srv = enabled&lt;/P&gt;

&lt;P&gt;&lt;U&gt;props.conf&lt;/U&gt;&lt;BR /&gt;&lt;BR /&gt;
[*]&lt;BR /&gt;&lt;BR /&gt;
FIELDALIAS-HostName = "tag::host" AS Host_Name&lt;/P&gt;</description>
      <pubDate>Thu, 17 Apr 2014 02:24:16 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/How-to-create-a-FIELDALIAS-for-a-tagged-field/m-p/134748#M27710</guid>
      <dc:creator>splunker12er</dc:creator>
      <dc:date>2014-04-17T02:24:16Z</dc:date>
    </item>
    <item>
      <title>Re: How to create a FIELDALIAS for a tagged field</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/How-to-create-a-FIELDALIAS-for-a-tagged-field/m-p/134749#M27711</link>
      <description>&lt;P&gt;tried with normal fields it works. But for tagged fields (tag::fieldname) it doesnt work.&lt;BR /&gt;
Any tricks to make this work ?&lt;/P&gt;</description>
      <pubDate>Thu, 17 Apr 2014 02:28:45 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/How-to-create-a-FIELDALIAS-for-a-tagged-field/m-p/134749#M27711</guid>
      <dc:creator>splunker12er</dc:creator>
      <dc:date>2014-04-17T02:28:45Z</dc:date>
    </item>
    <item>
      <title>Re: How to create a FIELDALIAS for a tagged field</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/How-to-create-a-FIELDALIAS-for-a-tagged-field/m-p/134750#M27712</link>
      <description>&lt;P&gt;It only works with "normal / regular" fields ... you could in your search try to "change" / format the tags (if possible) with the replace and or rename commands&lt;/P&gt;</description>
      <pubDate>Thu, 19 Jun 2014 13:34:25 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/How-to-create-a-FIELDALIAS-for-a-tagged-field/m-p/134750#M27712</guid>
      <dc:creator>lmyrefelt</dc:creator>
      <dc:date>2014-06-19T13:34:25Z</dc:date>
    </item>
    <item>
      <title>Re: How to create a FIELDALIAS for a tagged field</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/How-to-create-a-FIELDALIAS-for-a-tagged-field/m-p/134751#M27713</link>
      <description>&lt;P&gt;Heey man, thanks for the down vote!&lt;/P&gt;

&lt;P&gt;Take a few minutes and read the docs ... and you will se that it is not thought out to work the way you want. &lt;BR /&gt;
You could possible use a lookup instead .&lt;/P&gt;</description>
      <pubDate>Mon, 23 Jun 2014 06:38:05 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/How-to-create-a-FIELDALIAS-for-a-tagged-field/m-p/134751#M27713</guid>
      <dc:creator>lmyrefelt</dc:creator>
      <dc:date>2014-06-23T06:38:05Z</dc:date>
    </item>
  </channel>
</rss>

