I am currently trying to parse data to map to a specific CIM-compliant field name. Specifically, I have setup a field alias as such:
AffectedItems{}.Attachments ASNEW file_name
After creating this alias, when I do a search for the data, I can see the original field in the data, but file_name is only a fraction of the total events (%s are based on results at the time of my most recent search):
- AffectedItems{}.Attachments: 25.52% coverage
- file_name: 0.08% coverage
To clarify, I am trying to normalize this data for the CIM Email Datamodel. The small coverage is from another sourcetype where I had created a field alias:
messageParts{}.filename ASNEW file_name
In this second sourcetype, it's a much smaller amount of data, but they have an identical coverage of 98.9%. At first we theorized it may be an issue with the curly braces, but one alias works, but not another. Looking to see if anyone has encountered a similar issue and knows the cause.
