Knowledge Management

How to set up a field alias for a field that's already in the data for CIM compliance?

Path Finder

I'm trying to create a field alias for Enterprise Security so that the category field will generate correctly in the IDS Center in Splunk

My data source has a field name category that gives category on URL events and it also has a threat_category that gives details on the threat category. I'm trying to set up a field alias that would allow the CIM to pick up the threat_category so that it will will generate in Enterprise security and will ignore the original category which will only give the url category. What would be the best way to do this?

0 Karma


Creating a field alias should be simple enough in props.conf:

FIELDALIAS-category = threat_category as category

But depending on how the original category fields are created, I'm not sure if this will overwrite it OR will it overwrite this. Or the threat_category field may not even exist yet when this alias is called.

Do you know how those fields are created? Are they extractions, evals, lookups etc? That will probably drive the approach you have to take, including if you want to keep the original category value around in some other field.

See the doc below which describes the search time operation sequence

0 Karma
Get Updates on the Splunk Community!

Splunk Lantern | Spotlight on Security: Adoption Motions, War Stories, and More

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Cloud | Empowering Splunk Administrators with Admin Config Service (ACS)

Greetings, Splunk Cloud Admins and Splunk enthusiasts! The Admin Configuration Service (ACS) team is excited ...

Tech Talk | One Log to Rule Them All

One log to rule them all: how you can centralize your troubleshooting with Splunk logs We know how important ...