Aliases not working

[DanAlexander]

Hi All,

I am having an issue creating an alias simply going from DestinationPort to dest_port for SysMon EventID 3

I have tested:

index=my_index source=Sysmon

| eval destinationPort=dest_port

I have seen in Splunk TA Sysmon that there is FIELDALIAS-dest_port=DestinationPort AS dest_port

but still cannot convert DestinationPort to dest_port at Search time.

Any suggestions, please? There are no other apps contradicting the precedence.

Thank you!

[PickleRick]

And remember that for search-time operations it's important if you have enough permissions for the app (that should not typically be the issue here but it's worth checking out if all else fails)

[richgalloway]

Make sure the sourcetype on your data matches that for the FIELDALIAS.