https://community.splunk.com/t5/Getting-Data-In/How-to-assign-a-field-alias-to-a-json-field/m-p/298611#M56481 <P>it's always safe to enclose a field with special characters in single or double quotes.</P> Sat, 31 Mar 2018 03:55:54 GMT rsennett_splunk 2018-03-31T03:55:54Z https://community.splunk.com/t5/Getting-Data-In/How-to-assign-a-field-alias-to-a-json-field/m-p/298609#M56479 <P>We have the following in props.conf -</P> <PRE><CODE>FIELDALIAS-alias1 = apiRequest.apiInfo.clientID AS clientID </CODE></PRE> <P>It doesn't seem to do what we had in mind meaning to alias <CODE>apiRequest.apiInfo.clientID</CODE> as <CODE>clientID</CODE>.</P> Thu, 29 Mar 2018 21:56:25 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-assign-a-field-alias-to-a-json-field/m-p/298609#M56479 ddrillic 2018-03-29T21:56:25Z https://community.splunk.com/t5/Getting-Data-In/How-to-assign-a-field-alias-to-a-json-field/m-p/298610#M56480 <P>When we do the same exact thing from the UI, the UI adds double-quotes. I guess we need to do the same thing in <CODE>props.conf</CODE>.</P> Thu, 29 Mar 2018 22:11:29 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-assign-a-field-alias-to-a-json-field/m-p/298610#M56480 ddrillic 2018-03-29T22:11:29Z https://community.splunk.com/t5/Getting-Data-In/How-to-assign-a-field-alias-to-a-json-field/m-p/298611#M56481 <P>it's always safe to enclose a field with special characters in single or double quotes.</P> Sat, 31 Mar 2018 03:55:54 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-assign-a-field-alias-to-a-json-field/m-p/298611#M56481 rsennett_splunk 2018-03-31T03:55:54Z https://community.splunk.com/t5/Getting-Data-In/How-to-assign-a-field-alias-to-a-json-field/m-p/298612#M56482 <P>Makes perfect sense @rsennett.</P> Sat, 31 Mar 2018 22:28:10 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-assign-a-field-alias-to-a-json-field/m-p/298612#M56482 ddrillic 2018-03-31T22:28:10Z