https://community.splunk.com/t5/Knowledge-Management/How-do-I-read-the-field-alias/m-p/502344#M4559 <P>When I see - <CODE>FIELDALIAS-Status_as_Error_Code = Status AS Error_Code</CODE>.</P> <P>Does it mean that <CODE>Status</CODE> gets the value of <CODE>Error_Code</CODE> or the other way around?</P> Thu, 18 Jun 2020 18:51:57 GMT danielbb 2020-06-18T18:51:57Z https://community.splunk.com/t5/Knowledge-Management/How-do-I-read-the-field-alias/m-p/502344#M4559 <P>When I see - <CODE>FIELDALIAS-Status_as_Error_Code = Status AS Error_Code</CODE>.</P> <P>Does it mean that <CODE>Status</CODE> gets the value of <CODE>Error_Code</CODE> or the other way around?</P> Thu, 18 Jun 2020 18:51:57 GMT https://community.splunk.com/t5/Knowledge-Management/How-do-I-read-the-field-alias/m-p/502344#M4559 danielbb 2020-06-18T18:51:57Z https://community.splunk.com/t5/Knowledge-Management/How-do-I-read-the-field-alias/m-p/502345#M4560 <P>It is this:</P> <PRE><CODE>FIELDALIAS-&lt;class&gt; = &lt;orig_field_name&gt; AS &lt;new_field_name&gt; </CODE></PRE> <P>Described here:<BR /> <A href="https://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Configurefieldaliaseswithprops.conf">https://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Configurefieldaliaseswithprops.conf</A><BR /> So <CODE>Error_Code</CODE> gets the value of <CODE>Status</CODE>.</P> Sat, 21 Mar 2020 18:30:24 GMT https://community.splunk.com/t5/Knowledge-Management/How-do-I-read-the-field-alias/m-p/502345#M4560 woodcock 2020-03-21T18:30:24Z https://community.splunk.com/t5/Knowledge-Management/How-do-I-read-the-field-alias/m-p/502346#M4561 <P>Thank you @woodcock.</P> Sun, 22 Mar 2020 15:53:49 GMT https://community.splunk.com/t5/Knowledge-Management/How-do-I-read-the-field-alias/m-p/502346#M4561 danielbb 2020-03-22T15:53:49Z