Why is Field Alias not applying?

joshuasolman — Fri, 30 Jun 2023 15:12:36 GMT

Hey all,

When i run a search like this:

index=crowdstrike_pci sourcetype=crowdstrike:events:sensor event_simpleName=FileIntegrityMonitorRuleMatched | rename CommandLine AS process ContextTimeStamp AS file_access_time ImageFileName AS file_path ObjectName AS file_name ParentBaseFileName AS parent_process_exec ParentBaseFileName AS parent_process_name ParentCommandLine AS parent_process ParentImageFileName AS parent_process_path ParentProcessId AS parent_process_id RawProcessId AS process_id SHA256HashData AS file_hash UserName AS user aip AS dest event_platform AS os

The fields populate correctly, but when i hit up the Field Alias settings in the GUI to make them permanent, they dont appear in the search. Permissions are set for everyone to read all, and for sc_admin to write them. Its Splunk Cloud so i dont have access to the props.conf unless i upload one myself, but the field alias works for other sourcetypes, just not this one.

Any ideas?

Re: Why is Field Alias not applying?

dannymcdonald — Tue, 29 Aug 2023 17:33:29 GMT

Check the TA default configs or anything else for field aliases or evals that have the same name i.e. FIELDALIAS-user and EVAL-user in props or GUI. Either remove the duplicate field alias or eval, or rename them like FIELDALIAS-userTest and see if the new field pops up. I know the Crowdstrike TA 3.1.6 has duplicate names for user and severity which causes Splunk to drop the alias or eval altogether

topic Re: Why is Field Alias not applying? in Splunk Search

Why is Field Alias not applying?

Re: Why is Field Alias not applying?