I got an issue with a few field alias on extracted fields from a json log
This is done on a search head and done in the web gui
props.conf reads
[surcetype_name]
FIELDALIAS-<class> = field_name1 ASNEW alias1 field_name2 ASNEW alias2 field_name3 ASNEW alias3 field_name4 ASNEW alias4
EXTRACT-<class> = regex string to get field_name1
EXTRACT-<class> = regex string to get field_name2
EXTRACT-<class> = regex string to get field_name3
EXTRACT-<class> = regex string to get field_name4
According to https://docs.splunk.com/Documentation/Splunk/7.3.3/Knowledge/Searchtimeoperationssequence
As this is done in a searchhead the EXCTRACT-<class> is performed before FIELDALIAS-<class>
But there is only one of the aliases that returns data, when I do a table with the field_name and alias side by side I see that the exctraction is done right and there is data, but the alias is blank.
Anyone got a tip to what it can be that I got wrong here?
