When adding alert suppression fields with spaces in them should we use quotes around the field name?

[abroglesc]

Let's say we have an alert which has a few field like:

| search <INSERT_RANDOM_BASE_QUERY>
| table src_ip, _time, dest_ip
| rename _time as "Time", src_ip as "Source IP", dest_ip as "Destination IP"

And we want to suppress on "Source IP" and "Destination IP" being the same. Should our suppress fields look like:

alert.suppress.fields = "Source IP","Destination IP"

Or:

alert.suppress.fields = Source IP,Destination IP

 ?

[gcusello]

Hi @abroglesc,

at first, as @richgalloway said, if you have spaces in a field name, you have to use quotes, and in my experience it isn't a good idea to use spaces in field names, eventually you could rename them at the end of your search in column displaying.

Anyway, Taking always "Source IP" when present or "Destination IP" if the first isn't present, you could use eval coalesce:

| eval IP=coalesce("Source IP","Destination IP")

Ciao.

Giuseppe

[richgalloway]

Use quotation marks.  Without them you have 3 fields, one of which is repeated.