Field alias on extracted fields not working on all fields

erikwie — Wed, 10 Feb 2021 11:04:46 GMT

I got an issue with a few field alias on extracted fields from a json log
This is done on a search head and done in the web gui
props.conf reads
[surcetype_name]
FIELDALIAS-<class> = field_name1 ASNEW alias1 field_name2 ASNEW alias2 field_name3 ASNEW alias3 field_name4 ASNEW alias4
EXTRACT-<class> = regex string to get field_name1
EXTRACT-<class> = regex string to get field_name2
EXTRACT-<class> = regex string to get field_name3
EXTRACT-<class> = regex string to get field_name4

According to https://docs.splunk.com/Documentation/Splunk/7.3.3/Knowledge/Searchtimeoperationssequence

As this is done in a searchhead the EXCTRACT-<class> is performed before FIELDALIAS-<class>

But there is only one of the aliases that returns data, when I do a table with the field_name and alias side by side I see that the exctraction is done right and there is data, but the alias is blank.

Anyone got a tip to what it can be that I got wrong here?

topic Field alias on extracted fields not working on all fields in Getting Data In

Field alias on extracted fields not working on all fields