Getting Data In

field alias for 2 fields in same sourcetype

bcusick
Communicator

Hi,

I am trying to take 2 "user" fields that comes from the same sourcetype and give them the same alias. I have 2 fields, "cUser" and jUser. I want them both to point to "remote_user"

The problem is that only one of these works (c_user). My props.conf includes the following:

[VPN]
FIELDALIAS-extractUser = jUser AS remote_user
FIELDALIAS-extractUser = cUser AS remote_user
0 Karma
1 Solution

lguinn2
Legend

You gave both aliases the same name! Try this:

[VPN]
FIELDALIAS-extractUser1 = jUser AS remote_user
FIELDALIAS-extractUser2 = cUser AS remote_user

Although that may not work either, depending on the actual data in the events. Do you have any events that have both fields jUser and cUser?

View solution in original post

dolxor
Path Finder

We want to FIELDALIAS srcip and destip to ip (both, at the same time) - so ip would become a multi-value field, is this possible?

0 Karma

ddance_splunk
Splunk Employee
Splunk Employee

Hi

What you are trying to achieve could be done using an EVAL rather than a FIELDALIAS in your props.conf

[mysourcetype]
EVAL-ip=mvappend(src,dest)

Thanks
Darren

0 Karma

lguinn2
Legend

You gave both aliases the same name! Try this:

[VPN]
FIELDALIAS-extractUser1 = jUser AS remote_user
FIELDALIAS-extractUser2 = cUser AS remote_user

Although that may not work either, depending on the actual data in the events. Do you have any events that have both fields jUser and cUser?

christian_l
Path Finder

Is it possible this method no longer works?
I tried this one, but Spunk always fills up the field remote_user with the last entry appeared - in the above example with the values of cUser.
This happens even if I use different class-definitions.

0 Karma

HeinzWaescher
Motivator

Same problem here, I defined different names but it does not work as expected

0 Karma

rgaube
Explorer

Does not work for me either ... does anyone have an idea about how to solve this issue?

0 Karma

mwdbhyat
Builder

Anyone every resolve this?? I have the same problem.

0 Karma

bcusick
Communicator

🙂 I actually tried this right after I posted it. I was confused by the use of "class", thank you!

Kukkadapu
Path Finder

Hi , I've a same scenario where the events has both fileds jUser and cUser. So , how can I use the alias name?

Thanks

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...