topic Data model not picking up field alias in Reporting

Data model not picking up field alias

responsys_cm — Tue, 29 Sep 2020 20:30:19 GMT

I have installed the Suricata TA on my Splunk box. I am verifying that the data is flowing into the Intrusion Detection data model correctly.

The Suricata TA has the following field alias:

FIELDALIAS-suricata_global = proto AS transport src_ip AS src dest_ip AS dest

The following search shows the values of the "src" field correctly, but the "dest" field has thousands of events where "dest" is "unknown":

| datamodel Intrusion_Detection Network_IDS_Attacks search

But if I run this search on the raw events, I only see events that don't have the "dest" field in them:

sourcetype=suricata NOT dest=*

Can anyone think of a reason why two fields defined in the same FIELDALIAS- command would only have one of them populate with the values correctly? Both the src_ip and dest_ip fields are in the events, but the data model can't see the values for dest/dest_ip for some reason...

Re: Data model not picking up field alias

responsys_cm — Tue, 17 Jul 2018 21:11:09 GMT

I should also add that when I ran | datamodel Certificates search, the dest field is populating properly in that datamodel.

Neither datamodel is accelerated yet.

Re: Data model not picking up field alias

HiroshiSatoh — Wed, 18 Jul 2018 05:27:39 GMT

Is alias' permission global?

Re: Data model not picking up field alias

claudio_manig — Tue, 12 Feb 2019 11:45:48 GMT

I know its an old post but i had the same problem-
Solution was that i extracted all my fields using a delims transforms on a dedicated field extraction (basically the _raw event without header data). Now the datamodel was not aware of the underlying field extraction. Adding it as a field of the datamodel did the trick and all other fields showed up.

Re: Data model not picking up field alias

zschmerber — Wed, 30 Sep 2020 00:57:41 GMT

I have the same problem Suricata 2.3.3:
FIELDALIAS-suricata_global = proto AS transport src_ip AS src dest_ip AS dest
The alias is not adding dest to the logs that are tagged with tag=attack OR tag=ids.