topic Why are Splunk Field alias created from Ui not visible? in Splunk Search

Why are Splunk Field alias created from Ui not visible?

Yashprime07 — Mon, 24 Apr 2023 14:33:24 GMT

So I have an application that runs as a docker container in AWS ECS Fargate, and in log configurations for the container , I have used splunk log driver , here I have used --log-opt env to let say set a variable xyz, this variable appears now in the logs under attrs.xyz but I don't want to search everytime using this , so I used field alias in the settings -> fields -> new filed aliases and created xyz = attrs.xyz, but now I have created this field alias and I can't see it (use it to filter the search) but admin user can see this field although correct app - search was selected , and read permission to everyone was given

Re: Splunk Field alias is not visible , created from Ui

yuanliu — Sun, 23 Apr 2023 20:46:11 GMT

A shot in the dark about "read permission to everyone was given."

Does everyone see attrs.xyz? If not, that's the first place to troubleshoot.
If every one sees attrs.xyz but not xyz, can you elaborate what permissions are shown in Splunk? If I'm not mistaken, field aliases restrict permissions by application scope, not by user group or privilege. Is Sharing set to "Global" or is it in a specific application?

Re: Why are Splunk Field alias created from Ui not visible?

Yashprime07 — Mon, 24 Apr 2023 14:55:04 GMT

No , just one guy with admin access is able to see it. Everyone is able to see attrs.xyz but not xyz ( which I created as field alias [xyz as attrs.xyz] ) yeah application scope is set to search and also , in permissions , global sharing are set with read access to everyone

Re: Why are Splunk Field alias created from Ui not visible?

yuanliu — Tue, 25 Apr 2023 06:02:56 GMT

Ask your admin if you have Power User or equivalent permissions to share knowledge objects. Without such permissions, you can only create and manage your own. (Manage knowledge object permissions can give you some ideas.)

Re: Splunk Field alias is not visible , created from Ui

Yashprime07 — Thu, 27 Apr 2023 16:29:10 GMT

Thanks I had checked that but that wasn't the issue had verified all this before itself

Re: Splunk Field alias is not visible , created from Ui

yuanliu — Fri, 28 Apr 2023 06:06:00 GMT

I'm confused. This means that my answer is incorrect. So the problem isn't solved.

Re: Splunk Field alias is not visible , created from Ui

Yashprime07 — Fri, 28 Apr 2023 06:53:05 GMT

Naah the answer that you posted , i shared that with the admin user and did the trick

Re: Splunk Field alias is not visible , created from Ui

Yashprime07 — Fri, 28 Apr 2023 06:53:54 GMT

Regarding knowledge objects thanks ✌️