Getting Data In

If you need to create a new field alias that would be in two sourcetypes?

marka3721
Observer

I am getting conflicting information, so I just wanted to ask. If you need to create a new field alias that would be in two sourcetypes, do you need to create two different field aliases or just one.

Labels (1)
0 Karma

bowesmana
SplunkTrust
SplunkTrust

Aliases are created to apply to a source, sourcetype or host, so if you have 2 sourcetypes, that do not have common source/host, then you will need two aliases.

 

0 Karma
Get Updates on the Splunk Community!

Dashboard Studio Challenge - Learn New Tricks, Showcase Your Skills, and Win Prizes!

Reimagine what you can do with your dashboards. Dashboard Studio is Splunk’s newest dashboard builder to ...

Introducing Edge Processor: Next Gen Data Transformation

We get it - not only can it take a lot of time, money and resources to get data into Splunk, but it also takes ...

Take the 2021 Splunk Career Survey for $50 in Amazon Cash

Help us learn about how Splunk has impacted your career by taking the 2021 Splunk Career Survey. Last year’s ...