topic Re: field alias for 2 fields in same sourcetype in Getting Data In

field alias for 2 fields in same sourcetype

bcusick — Tue, 10 Jun 2014 16:27:12 GMT

Hi,

I am trying to take 2 "user" fields that comes from the same sourcetype and give them the same alias. I have 2 fields, "cUser" and jUser. I want them both to point to "remote_user"

The problem is that only one of these works (c_user). My props.conf includes the following:

[VPN]
FIELDALIAS-extractUser = jUser AS remote_user
FIELDALIAS-extractUser = cUser AS remote_user

Re: field alias for 2 fields in same sourcetype

lguinn2 — Tue, 10 Jun 2014 17:48:55 GMT

You gave both aliases the same name! Try this:

[VPN]
FIELDALIAS-extractUser1 = jUser AS remote_user
FIELDALIAS-extractUser2 = cUser AS remote_user

Although that may not work either, depending on the actual data in the events. Do you have any events that have both fields jUser and cUser?

Re: field alias for 2 fields in same sourcetype

bcusick — Tue, 10 Jun 2014 17:52:14 GMT

🙂 I actually tried this right after I posted it. I was confused by the use of "class", thank you!

Re: field alias for 2 fields in same sourcetype

Kukkadapu — Mon, 25 Jan 2016 18:48:15 GMT

Hi , I've a same scenario where the events has both fileds jUser and cUser. So , how can I use the alias name?

Thanks

Re: field alias for 2 fields in same sourcetype

christian_l — Thu, 19 May 2016 13:31:13 GMT

Is it possible this method no longer works?
I tried this one, but Spunk always fills up the field remote_user with the last entry appeared - in the above example with the values of cUser.
This happens even if I use different class-definitions.

Re: field alias for 2 fields in same sourcetype

HeinzWaescher — Tue, 07 Jun 2016 12:50:08 GMT

Same problem here, I defined different names but it does not work as expected

Re: field alias for 2 fields in same sourcetype

rgaube — Fri, 12 May 2017 15:36:42 GMT

Does not work for me either ... does anyone have an idea about how to solve this issue?

Re: field alias for 2 fields in same sourcetype

mwdbhyat — Fri, 09 Feb 2018 15:15:04 GMT

Anyone every resolve this?? I have the same problem.

Re: field alias for 2 fields in same sourcetype

dolxor — Tue, 05 Jun 2018 11:22:53 GMT

We want to FIELDALIAS srcip and destip to ip (both, at the same time) - so ip would become a multi-value field, is this possible?

Re: field alias for 2 fields in same sourcetype

ddance_splunk — Tue, 26 Jun 2018 12:13:18 GMT

What you are trying to achieve could be done using an EVAL rather than a FIELDALIAS in your props.conf

[mysourcetype]
EVAL-ip=mvappend(src,dest)

Thanks
Darren