Knowledge Management

Field aliases not parsing fields from Exchange

kevinbriggs85
New Member

I am currently trying to parse data to map to a specific CIM-compliant field name. Specifically, I have setup a field alias as such:

AffectedItems{}.Attachments ASNEW file_name

After creating this alias, when I do a search for the data, I can see the original field in the data, but file_name is only a fraction of the total events (%s are based on results at the time of my most recent search):

  • AffectedItems{}.Attachments: 25.52% coverage
  • file_name: 0.08% coverage

To clarify, I am trying to normalize this data for the CIM Email Datamodel. The small coverage is from another sourcetype where I had created a field alias:

messageParts{}.filename ASNEW file_name

In this second sourcetype, it's a much smaller amount of data, but they have an identical coverage of 98.9%. At first we theorized it may be an issue with the curly braces, but one alias works, but not another. Looking to see if anyone has encountered a similar issue and knows the cause.

Labels (1)
Tags (1)
0 Karma
Get Updates on the Splunk Community!

Splunk Education - Fast Start Program!

Welcome to Splunk Education! Splunk training programs are designed to enable you to get started quickly and ...

Five Subtly Different Ways of Adding Manual Instrumentation in Java

You can find the code of this example on GitHub here. Please feel free to star the repository to keep in ...

New Splunk APM Enhancements Help Troubleshoot Your MySQL and NoSQL Databases Faster

Splunk Observability has two new enhancements to make it quicker and easier to troubleshoot slow or frequently ...