Fortinet FortiGate Add-On field alias for rule (data model Network traffic)

[splunkreal]

Hello, we would like to have rule_id as rule instead of poluuid as rule in field aliases.

Is it adviced to modify original addon field alias in order to get that field in the Network Traffic data model?

Modify this: FIELDALIAS-fortigate_traffic_rule            = poluuid as rule

Fortinet Fortigate Add-on v1.6.7

Thanks!

[livehybrid]

Hi @splunkreal 

You have a couple of options, which might depend on how you might manage your environment and/or other precedence set.

1) Update the FIELDALIAS as you have pictured. This will create the change in the local directory of the Splunk_TA_fortinet_fortigate app. This is probably the easiest option for you.

2) Create a custom app and create a props.conf file within it containing the FIELDALIAS for the specific sourcetype. If you create the props.conf in the 'default' directory then you would need to make sure the app is named to have a higher order precedence than Splunk_TA_fortinet_fortigate in the user context (e.g. myorg_fortinet_props) - see https://help.splunk.com/en/data-management/splunk-enterprise-admin-manual/9.4/administer-splunk-ente... for more info

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing