https://community.splunk.com/t5/Knowledge-Management/How-to-avoid-duplicate-fields-in-CIM-Data-Normalization/m-p/630801#M9244 <P>Having two aliases for the same field will result in 3 fields (the original plus 2 aliases) with the same data.&nbsp; That may be necessary for some use cases, which means you have to live with it.&nbsp; Fortunately, aliases are search-time operations so no storage is consumed.&nbsp; If you don't have a need for multiple aliases for the same data then remove one of them.</P> Tue, 14 Feb 2023 13:49:12 GMT richgalloway 2023-02-14T13:49:12Z https://community.splunk.com/t5/Knowledge-Management/How-to-avoid-duplicate-fields-in-CIM-Data-Normalization/m-p/630693#M9241 <P>Hi Team,</P> <P>I am using field aliases as in my sourcetype i have two common fields (dest &amp; dest_ip) which have same values.<BR />When i applied field aliases both were reflecting.</P> <P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="Atchyuth_P_0-1676313476036.png" style="width: 400px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/23844iDC674B9E68FB1FDB/image-size/medium?v=v2&amp;px=400" role="button" title="Atchyuth_P_0-1676313476036.png" alt="Atchyuth_P_0-1676313476036.png" /></span></P> <P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="Atchyuth_P_1-1676313720897.png" style="width: 400px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/23845iC839F79AD7278A81/image-size/medium?v=v2&amp;px=400" role="button" title="Atchyuth_P_1-1676313720897.png" alt="Atchyuth_P_1-1676313720897.png" /></span></P> <P>How to avoid duplicate fields<BR /><BR />Kindly help in this scenario</P> Mon, 13 Feb 2023 23:32:49 GMT https://community.splunk.com/t5/Knowledge-Management/How-to-avoid-duplicate-fields-in-CIM-Data-Normalization/m-p/630693#M9241 Atchyuth_P 2023-02-13T23:32:49Z https://community.splunk.com/t5/Knowledge-Management/How-to-avoid-duplicate-fields-in-CIM-Data-Normalization/m-p/630801#M9244 <P>Having two aliases for the same field will result in 3 fields (the original plus 2 aliases) with the same data.&nbsp; That may be necessary for some use cases, which means you have to live with it.&nbsp; Fortunately, aliases are search-time operations so no storage is consumed.&nbsp; If you don't have a need for multiple aliases for the same data then remove one of them.</P> Tue, 14 Feb 2023 13:49:12 GMT https://community.splunk.com/t5/Knowledge-Management/How-to-avoid-duplicate-fields-in-CIM-Data-Normalization/m-p/630801#M9244 richgalloway 2023-02-14T13:49:12Z