topic Re: Field alaises in Splunk Search

Field alaises

Ephrem32 — Fri, 04 Dec 2020 06:46:47 GMT

my field aliases are set like this:

browser = BROWSER

referrer = REFERRER

req=REQ

req_id=REQ=ID

src=SRC

During my search in the csv that includes these field aliases: I get all of the results in my field except req=REQ. I only get req but not REQ. Why is that and how would I be able to fix this?

Thank you,

Re: Field alaises

gcusello — Fri, 04 Dec 2020 07:43:15 GMT

Hi @Ephrem32,

I think that "req_id=REQ=ID" it's probably an error in tis question, otherwise, check it because you're renaming REQ in ID.

Anyway, check the permissions in your aliases.

Ciao.

Giuseppe

Re: Field alaises

Ephrem32 — Fri, 04 Dec 2020 11:26:21 GMT

My apologies that was the typo. I checked the permission its on Global and has the admin roles selected which is correct. I still do not get REQ in my interested fields in my search. Any other reasons? Thanks

@gcusello

browser = BROWSER

referrer = REFERRER

req=REQ

req_id=REQ_ID

src=SRC

Re: Field alaises

gcusello — Fri, 04 Dec 2020 12:30:11 GMT

Hi @Ephrem32,

could you share the content of you aliases?

you should have:

BROWSER AS browser
REFERRER AS referrer
REQ AS req
REQ_ID AS req_id
SRC AS src

You can find them in [Settings -- Fields -- Aliases]

Ciao.

Giuseppe