topic Re: When adding alert suppression fields with spaces in them should we use quotes around the field name? in Alerting

When adding alert suppression fields with spaces in them should we use quotes around the field name?

abroglesc — Tue, 20 Sep 2022 18:43:38 GMT

Let's say we have an alert which has a few field like:

| search <INSERT_RANDOM_BASE_QUERY> | table src_ip, _time, dest_ip | rename _time as "Time", src_ip as "Source IP", dest_ip as "Destination IP"

And we want to suppress on "Source IP" and "Destination IP" being the same. Should our suppress fields look like:

alert.suppress.fields = "Source IP","Destination IP"

Or:

alert.suppress.fields = Source IP,Destination IP

Re: When adding alert suppression fields with spaces in them should we use quotes around the field name?

richgalloway — Tue, 20 Sep 2022 19:48:58 GMT

Use quotation marks. Without them you have 3 fields, one of which is repeated.

Re: When adding alert suppression fields with spaces in them should we use quotes around the field name?

gcusello — Wed, 21 Sep 2022 06:52:21 GMT

Hi @abroglesc,

at first, as @richgalloway said, if you have spaces in a field name, you have to use quotes, and in my experience it isn't a good idea to use spaces in field names, eventually you could rename them at the end of your search in column displaying.

Anyway, Taking always "Source IP" when present or "Destination IP" if the first isn't present, you could use eval coalesce:

| eval IP=coalesce("Source IP","Destination IP")

Ciao.

Giuseppe