field alias for 2 fields in same sourcetype

[bcusick]

Hi,

I am trying to take 2 "user" fields that comes from the same sourcetype and give them the same alias. I have 2 fields, "cUser" and jUser. I want them both to point to "remote_user"

The problem is that only one of these works (c_user). My props.conf includes the following:

[VPN]
FIELDALIAS-extractUser = jUser AS remote_user
FIELDALIAS-extractUser = cUser AS remote_user

[dolxor]

We want to FIELDALIAS srcip and destip to ip (both, at the same time) - so ip would become a multi-value field, is this possible?

[ddance_splunk]

Hi

What you are trying to achieve could be done using an EVAL rather than a FIELDALIAS in your props.conf

[mysourcetype]
EVAL-ip=mvappend(src,dest)

Thanks
Darren

[lguinn2 · Accepted solution]

You gave both aliases the same name! Try this:

[VPN]
FIELDALIAS-extractUser1 = jUser AS remote_user
FIELDALIAS-extractUser2 = cUser AS remote_user

Although that may not work either, depending on the actual data in the events. Do you have any events that have both fields jUser and cUser?

[christian_l]

Is it possible this method no longer works?
I tried this one, but Spunk always fills up the field remote_user with the last entry appeared - in the above example with the values of cUser.
This happens even if I use different class-definitions.

[HeinzWaescher]

Same problem here, I defined different names but it does not work as expected

[rgaube]

Does not work for me either ... does anyone have an idea about how to solve this issue?

[mwdbhyat]

Anyone every resolve this?? I have the same problem.

[bcusick]

🙂 I actually tried this right after I posted it. I was confused by the use of "class", thank you!

[Kukkadapu]

Hi , I've a same scenario where the events has both fileds jUser and cUser. So , how can I use the alias name?

Thanks