All Apps and Add-ons

Error on props.conf


FIELDALIAS-storm = fw AS dvc dst AS dest dstif AS dest_interface dstport AS dest_port ipproto AS transport ruleid AS rule srcif AS src_interface srcport as src_port dstportname AS app action AS vendor_action result AS status op AS http_method sent AS bytes_out rcvd AS bytes_in arg AS uri_query cat_site AS category address AS dest

dst AS dest
address AS dest

i think it's dst AS dest_ip.

Tags (1)
0 Karma

Super Champion

I feel the above code is bit clunky (or overuse/abuse of FIELDALIAS). To keep it simple and future debug friendly, it is better to write in multiple lines

FIELDALIAS-dest1 = dst AS dest_ip dstport AS dest_port dstportname AS app dstif AS dest_interface address AS dest
FIELDALIAS-src1 = srcport as src_port  srcif AS src_interface 
FIELDALIAS-flow1 = ipproto AS transport sent AS bytes_out rcvd AS bytes_in 
FIELDALIAS-payload1 = ruleid AS rule op AS http_method arg AS uri_query 
FIELDALIAS-others1 = result AS status action AS vendor_action  cat_site AS category 

I would even write it in individual lines, to make it easier to debug/automate in future

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!