- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
If you need to create a new field alias that would be in two sourcetypes?
marka3721
Loves-to-Learn
11-14-2022
01:42 PM
I am getting conflicting information, so I just wanted to ask. If you need to create a new field alias that would be in two sourcetypes, do you need to create two different field aliases or just one.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
bowesmana

SplunkTrust
11-14-2022
02:31 PM
Aliases are created to apply to a source, sourcetype or host, so if you have 2 sourcetypes, that do not have common source/host, then you will need two aliases.
