topic help on splunk field aliases not visible in Splunk Search

help on splunk field aliases not visible

jip31 — Wed, 01 Nov 2023 11:58:28 GMT

hello

I have a admin role

when I create a field alias, I can see it in the props.conf file but when I run the search the field names are unchanged

[sourcetype="Perfmon:mem"] FIELDALIAS-Value = Value AS titi counter AS tutu

what is wrong please?

gcusello — Wed, 01 Nov 2023 10:54:05 GMT

when you use sourcetype, you don't need to specify it;

[Perfmon:mem] FIELDALIAS-Value = Value AS titi counter AS tutu

only for host and source you have to specify them but with a different syntax:

[source::your_source] FIELDALIAS-Value = Value AS titi counter AS tutu [host::your_host] FIELDALIAS-Value = Value AS titi counter AS tutu

Ciao.

Giuseppe

gcusello — Wed, 01 Nov 2023 12:02:57 GMT

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉