Getting Data In

Why is my field alias only applied for 1 of 2 fields specified in props.conf?



Trying to build a parser, but facing the below issue.

I extracted two fields from my logs: action_failed and action_success
Later, I gave them a field alias as below:

action_failed as action1 
action_success as action1

linked them to a lookup:

mylookup action1 OUTPUT action

The issue is that only one field is parsed, and that is the first one in my case action_failed, the other field is not picked. Is there any solution for this?

0 Karma


You are probably using the same class names in the field alias

if you use FIELDALIAS-action = on both only one will work.
try something like this:

FIELDALIAS-failed_action = action_failed as action1 
FIELDALIAS-success_action = action_success as action1
Hope I was able to help you. If so, some karma would be appreciated.


Hi himapate,

try to not use field alias . If you extract both fields (action_failed,action_success) manuelly you can achive the same result as the field alias just by extracting the same value into two fields.

Regex 1: 

" ... (?<action1>(?<action_failed>....))..."

Regex 2:

" ... (?<action1>(?<action_success>....))..."

Hope it helps.


0 Karma
Get Updates on the Splunk Community!

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...