Solved: Re: How do I read the field alias? - Splunk Community

Knowledge Management

When I see - FIELDALIAS-Status_as_Error_Code = Status AS Error_Code.

Does it mean that Status gets the value of Error_Code or the other way around?

1 Solution

Solution

It is this:

FIELDALIAS-<class> = <orig_field_name> AS <new_field_name>

Described here:
https://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Configurefieldaliaseswithprops.conf
So Error_Code gets the value of Status.

View solution in original post

Solution

It is this:

FIELDALIAS-<class> = <orig_field_name> AS <new_field_name>

Described here:
https://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Configurefieldaliaseswithprops.conf
So Error_Code gets the value of Status.

Thank you @woodcock.

Get Updates on the Splunk Community!

A Four-Part Event Series: Full Stack Observability For the AI Era

As AI reshapes applications, infrastructure, and the way teams operate, the traditional boundaries of ...

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

The new SOC4Kafka connector, built on OpenTelemetry, enables the collection of Kafka messages and forwards ...

Event Series: Level up your SOC: Advancing with Splunk Enterprise Security

AI has fundamentally raised the stakes for security operations, and this three-part series is your guide to ...