Splunk Add-on for Cisco Identity Services: How to prevent the UserName field from being overwritten by overlapping field aliases?

[stboch]

There are several overlapping field aliases causing inconsistent issues.

I recommend the following changes.

Before:

FIELDALIAS-cisco-ise-user_name-as-UserName = User_Name AS UserName

After:

FIELDALIAS-cisco-ise-user_name-as-UserName = User_Name AS user

The UserName field is used in part of the ISE log services, and is being overwritten inconsistently with blank data.

[stboch · Accepted solution]

I recommend the following changes.

Before:

FIELDALIAS-cisco-ise-user_name-as-UserName = User_Name AS UserName

After:

FIELDALIAS-cisco-ise-user_name-as-UserName = User_Name AS user

[ppablo]

Hi @stboch

Thanks for sharing this tip on Splunk Answers for the rest of the community. Could you actually post the solution below in the "Enter your answer here..." box? We can then accept the answer to resolve the post so this question displays as having a working solution.

[stboch]

I copied the information into an answer