topic How to define field alias on extracted fields? in Splunk Search

How to define field alias on extracted fields?

sabaKhadivi — Mon, 22 Apr 2019 10:03:23 GMT

I extracted some fields from raw log , and I want to define field alias for them , but on specific field which is used in other indexes and has field alias ,the alias doesn't work .

Re: How to define field alias on extracted fields?

somesoni2 — Mon, 22 Apr 2019 13:12:04 GMT

The field alias is set at sourcetype/source/host level. Where have you setup your field alias and did you use correct sourcetype/source/host?

Re: How to define field alias on extracted fields?

PowerPacked — Mon, 22 Apr 2019 19:45:17 GMT

If you extracted those fields by eval, its not gonna work as there is a sequence in search time operations. - field alias comes before eval ( calculated fields)

Please take a look at this sequence of search time operation, which means every search ran in UI go through these operations in order.

https://docs.splunk.com/Documentation/Splunk/7.2.6/Knowledge/Searchtimeoperationssequence

Thanks

Re: How to define field alias on extracted fields?

sabaKhadivi — Tue, 23 Apr 2019 04:00:22 GMT

Thanks for your answer, but I use inline extraction which is in the firest sequnece , that field alias work on some indexes and don't work on the others.

Re: How to define field alias on extracted fields?

sabaKhadivi — Tue, 23 Apr 2019 04:01:34 GMT

I setted it up from field bar , and I default it based on host .

Re: How to define field alias on extracted fields?

PowerPacked — Tue, 23 Apr 2019 04:40:22 GMT

Does that means you have Extract-classname in props of searchhead for above extracted fields?

Thanks

Re: How to define field alias on extracted fields?

sabaKhadivi — Tue, 23 Apr 2019 10:04:01 GMT

yes exactly, the problem is solved ,it was related to host::* whitch cause conflict with other configuration by TAs. when I restrict host ,it just work!!!