Getting Data In

Field alias on extracted fields not working on all fields

erikwie
Path Finder

I got an issue with a few field alias on extracted fields from a json log 
This is done on a search head and done in the web gui
props.conf reads
[surcetype_name]
FIELDALIAS-<class> = field_name1 ASNEW alias1 field_name2 ASNEW alias2 field_name3 ASNEW alias3 field_name4 ASNEW alias4
EXTRACT-<class> = regex string to get field_name1
EXTRACT-<class> = regex string to get field_name2
EXTRACT-<class> = regex string to get field_name3
EXTRACT-<class> = regex string to get field_name4

According to https://docs.splunk.com/Documentation/Splunk/7.3.3/Knowledge/Searchtimeoperationssequence

As this is done in a searchhead the EXCTRACT-<class> is performed before FIELDALIAS-<class>

But there is only one of the aliases that returns data, when I do a table with the field_name and alias side by side I see that the exctraction is done right and there is data, but the alias is blank.

Anyone got a tip to what it can be that I got wrong here?

Labels (1)
Tags (1)
0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...