topic Aliases not working in Knowledge Management

Aliases not working

DanAlexander — Tue, 24 Oct 2023 14:09:22 GMT

Hi All,

I am having an issue creating an alias simply going from DestinationPort to dest_port for SysMon EventID 3

I have tested:

index=my_index source=Sysmon | eval destinationPort=dest_port

I have seen in Splunk TA Sysmon that there is FIELDALIAS-dest_port=DestinationPort AS dest_port

but still cannot convert DestinationPort to dest_port at Search time.

Any suggestions, please? There are no other apps contradicting the precedence.

Thank you!

Re: Aliases not working

richgalloway — Tue, 24 Oct 2023 12:54:06 GMT

Make sure the sourcetype on your data matches that for the FIELDALIAS.

Re: Aliases not working

PickleRick — Tue, 24 Oct 2023 13:09:10 GMT

And remember that for search-time operations it's important if you have enough permissions for the app (that should not typically be the issue here but it's worth checking out if all else fails)