topic Re: FieldAlias Setup in Splunk Search

FieldAlias Setup

wildbill4 — Fri, 17 Sep 2010 20:04:46 GMT

I'm trying to setup Fieldalias and not getting desire results. Here is what I have put into the props.conf file.

  FIELDALIAS = acct AS account
  FIELDALIAS = User_Name AS account

Am I missing something??

Thanks

Re: FieldAlias Setup

southeringtonp — Fri, 17 Sep 2010 20:26:31 GMT

Your second FIELDALIAS statement will override the first.

Try adding an extension so that you have two unique entries:

FIELDALIAS-acct = acct AS account
FIELDALIAS-username = User_Name AS account

Alternately, you can have both aliases in a single line. If you go that route, you will still override any previously defined value for FIELDALIAS=, so it's still a good idea to add a qualifier as shown above.

Re: FieldAlias Setup

wildbill4 — Fri, 17 Sep 2010 20:41:42 GMT

Does it matter where in the props.conf file I input the FIELDALIAS information?

Re: FieldAlias Setup

southeringtonp — Fri, 17 Sep 2010 21:12:15 GMT

It will have to be in a stanza that matches the sourcetype (or host, or source) for which you want to set the field alias. Other than that, it doesn't matter as long as it's a unique entry as above. If it's non-unique, then you have to worry about precedence rules, since another entry could override it (possibly from a different app). Also, I'm assuming you're only trying to use it within the search app -- if you need it across multiple apps you'll need to check the permissions and make sure it's set to global.

Re: FieldAlias Setup

wildbill4 — Fri, 17 Sep 2010 21:13:50 GMT

Thanks for the assistance

Re: FieldAlias Setup

Dan — Tue, 19 Oct 2010 08:05:08 GMT

Unfortunately, field aliasing is one-to-one, and won't allow you to map many-to-one. The reason is that if orig_field doesn't exist, a blank value will be assigned to new_field.

Consider an event that has only the acct field. Both FIELDALIAS directives will be evaluated. Lexicographically, FIELDALIAS-acct runs first and successfully aliases acct as account. But when FIELDALIAS-username runs it finds no User_Name field, so the result is the account field will be blank.

There are two ways to work around this.

Use props.conf:

REPORT-alias_account = acct_as_account,User_Name_as_account

and transforms.conf:

[acct_as_account]
SOURCE_KEY = acct
REGEX = (?<account>.+)
[User_Name_as_account]
SOURCE_KEY = User_Name
REGEX = (?<account>.+)

Use the search language:

| eval account= IF(ISNULL(acct),User_Name,acct)