How to use field aliases to rename a column in a dashboard?

[neillnetzeband]

We have a dashboard that shows the status codes (which we filter through checkboxes) for all of our web server farms. It is set up properly for all of our IIS servers as the status code field is "sc_status," but for our one web server farm that is Linux, the status code field is "status" so I can't pass the tokens from our checkbox input filter.

What is the best way to rename a field for this situation?

[horsefez · Accepted solution]

Hi @neillneteband,

I think Field Aliases could help you solve your problem.

You can easily give one of your fields an alias name and afterwards your shouldn't have any problems anymore.

https://docs.splunk.com/Documentation/Splunk/7.1.2/Knowledge/Addaliasestofields

Tell me if you need any further assistance. 😃

[neillnetzeband]

Thanks, this works perfectly!