topic Re: Why am I not able to see field alias added to attrs.labelname? in Splunk Search

Why am I not able to see field alias added to attrs.labelname?

Yashprime07 — Thu, 20 Apr 2023 16:47:07 GMT

I created the field alias with read access given to everyone but still I am not able to see it, could someone please help here?

Re: Why am I not able to see field alias added to attrs.labelname?

Yashprime07 — Thu, 20 Apr 2023 17:47:05 GMT

Could someone please help here ?

Re: Why am I not able to see field alias added to attrs.labelname?

richgalloway — Thu, 20 Apr 2023 19:54:36 GMT

Help us to help you. How did you create the alias? On which instance type(s)? If you edited a .conf file did you restart the instance? What exactly do you mean by "I am not able to see it"? How and where are you looking for it?

These message boards are not real-time help. Expecting a response in a hour is not reasonable given the rest of us have jobs, too. For something closer to real-time assistance, use Slack.

Re: Why am I not able to see field alias added to attrs.labelname?

Yashprime07 — Fri, 21 Apr 2023 04:06:56 GMT

So I have an application that runs as a docker container in AWS ECS Fargate, and in log configurations for the container , I have used splunk log driver , here I have used --log-opt env to let say set a variable xyz, this variable appears now in the logs under attrs.xyz but I don't want to search everytime using this , so I used field alias in the settings -> fields -> new filed aliases and created xyz = attrs.xyz, but now I have created this field alias and I can't see it (use it to filter the search) but admin user can see this field although correct app - search was selected , and read permission to everyone was given.