Knowledge Management

Conditional Field Alias (Not in search bar)

shayhibah
Path Finder

I would like to map to data model and want that specific field to behave like A=B only if C="some value" (A is the new field while B,C are existing fields).

I tried to go to setting and under "Field Aliases" looked for condition but I could not find.

Does someone know how to do it?

Thanks

Tags (1)
0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@shayhibah,

Is it possible to use Calculated fields?

Fields » Calculated fields » Add new

0 Karma
Get Updates on the Splunk Community!

Splunk MCP & Agentic AI: Machine Data Without Limits

  Discover how the Splunk Model Context Protocol (MCP) Server can revolutionize the way your organization ...

Finding Based Detections General Availability

Overview  We’ve come a long way, folks, but here in Enterprise Security 8.4 I’m happy to announce Finding ...

Get Your Hands Dirty (and Your Shoes Comfy): The Splunk Experience

Hands-On Learning and Technical Seminars  Sometimes, you just need to see the code. For those looking for a ...