Getting Data In

If you need to create a new field alias that would be in two sourcetypes?

marka3721
Loves-to-Learn

I am getting conflicting information, so I just wanted to ask. If you need to create a new field alias that would be in two sourcetypes, do you need to create two different field aliases or just one.

Labels (1)
0 Karma

bowesmana
SplunkTrust
SplunkTrust

Aliases are created to apply to a source, sourcetype or host, so if you have 2 sourcetypes, that do not have common source/host, then you will need two aliases.

 

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...