Getting Data In

field alias for 2 fields in same sourcetype

Communicator

Hi,

I am trying to take 2 "user" fields that comes from the same sourcetype and give them the same alias. I have 2 fields, "cUser" and jUser. I want them both to point to "remote_user"

The problem is that only one of these works (c_user). My props.conf includes the following:

[VPN]
FIELDALIAS-extractUser = jUser AS remote_user
FIELDALIAS-extractUser = cUser AS remote_user
0 Karma
1 Solution

Legend

You gave both aliases the same name! Try this:

[VPN]
FIELDALIAS-extractUser1 = jUser AS remote_user
FIELDALIAS-extractUser2 = cUser AS remote_user

Although that may not work either, depending on the actual data in the events. Do you have any events that have both fields jUser and cUser?

View solution in original post

Path Finder

We want to FIELDALIAS srcip and destip to ip (both, at the same time) - so ip would become a multi-value field, is this possible?

0 Karma

Splunk Employee
Splunk Employee

Hi

What you are trying to achieve could be done using an EVAL rather than a FIELDALIAS in your props.conf

[mysourcetype]
EVAL-ip=mvappend(src,dest)

Thanks
Darren

0 Karma

Legend

You gave both aliases the same name! Try this:

[VPN]
FIELDALIAS-extractUser1 = jUser AS remote_user
FIELDALIAS-extractUser2 = cUser AS remote_user

Although that may not work either, depending on the actual data in the events. Do you have any events that have both fields jUser and cUser?

View solution in original post

Path Finder

Is it possible this method no longer works?
I tried this one, but Spunk always fills up the field remote_user with the last entry appeared - in the above example with the values of cUser.
This happens even if I use different class-definitions.

0 Karma

Motivator

Same problem here, I defined different names but it does not work as expected

0 Karma

Explorer

Does not work for me either ... does anyone have an idea about how to solve this issue?

0 Karma

Builder

Anyone every resolve this?? I have the same problem.

0 Karma

Communicator

🙂 I actually tried this right after I posted it. I was confused by the use of "class", thank you!

Path Finder

Hi , I've a same scenario where the events has both fileds jUser and cUser. So , how can I use the alias name?

Thanks

0 Karma