topic Field Alais created were not working in Splunk Search

Field Alais created were not working

Gowtham0809 — Tue, 17 Sep 2019 05:17:56 GMT

We have created several Field aliases based on different source and source types in our splunk query.

Most of the Field alias created were working without ant issues, but some of the alias created were not visible for splunk searches?

Can someone suggest any workaround for this?. This occurs when Alias were created on on both source and sourcetypes but not for all the alias we created.

Thanks,

Re: Field Alais created were not working

mattchiste — Tue, 17 Sep 2019 12:09:40 GMT

Check out: https://docs.splunk.com/Documentation/Splunk/7.3.0/ReleaseNotes/Fieldaliasbehaviorchange.

The behavior of Field Aliases have changed in 7.2 and 7.3 over previous versions. That article does a good job of explaining how and why. You probably want to use coalesce or the new AS NEW keyword.

Re: Field Alais created were not working

Gowtham0809 — Tue, 17 Sep 2019 12:43:34 GMT

Hello, I have sorted the issue by providing the providing source as file level. for example. I have a folder structure C:\temp\Splunkdata\alias*.csv

earlier I was using the source as C:\temp\Splunkdata* in the alias context and when i chnaged the source as C:\temp\Splunkdata\alias* all my alias started working.

Does thus mean do I need to provide the source path in file level is the best practice, or my providing source path upto top level folders should also work?

Thanks

Re: Field Alais created were not working

mattchiste — Wed, 18 Sep 2019 13:44:12 GMT

You probably have more than one FieldAlias defined for C:\temp\Splunkdata\ and they are interacting in ways you aren't expecting. By changing the source to something more explicit, the FieldAlias is likely the only unique one for that source.