All Apps and Add-ons

Error on props.conf

bricevaixagon
Explorer

FIELDALIAS-storm = fw AS dvc dst AS dest dstif AS dest_interface dstport AS dest_port ipproto AS transport ruleid AS rule srcif AS src_interface srcport as src_port dstportname AS app action AS vendor_action result AS status op AS http_method sent AS bytes_out rcvd AS bytes_in arg AS uri_query cat_site AS category address AS dest

dst AS dest
AND
address AS dest

i think it's dst AS dest_ip.

Tags (1)
0 Karma

koshyk
Super Champion

I feel the above code is bit clunky (or overuse/abuse of FIELDALIAS). To keep it simple and future debug friendly, it is better to write in multiple lines

FIELDALIAS-dest1 = dst AS dest_ip dstport AS dest_port dstportname AS app dstif AS dest_interface address AS dest
FIELDALIAS-src1 = srcport as src_port  srcif AS src_interface 
FIELDALIAS-flow1 = ipproto AS transport sent AS bytes_out rcvd AS bytes_in 
FIELDALIAS-payload1 = ruleid AS rule op AS http_method arg AS uri_query 
FIELDALIAS-others1 = result AS status action AS vendor_action  cat_site AS category 

I would even write it in individual lines, to make it easier to debug/automate in future

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...