How to set up a field alias for a field that's already in the data for CIM compliance?

[mrtolu6]

I'm trying to create a field alias for Enterprise Security so that the category field will generate correctly in the IDS Center in Splunk

My data source has a field name category that gives category on URL events and it also has a threat_category that gives details on the threat category. I'm trying to set up a field alias that would allow the CIM to pick up the threat_category so that it will will generate in Enterprise security and will ignore the original category which will only give the url category. What would be the best way to do this?

[maciep]

Creating a field alias should be simple enough in props.conf:

[your_sourcetype]
FIELDALIAS-category = threat_category as category

But depending on how the original category fields are created, I'm not sure if this will overwrite it OR will it overwrite this. Or the threat_category field may not even exist yet when this alias is called.

Do you know how those fields are created? Are they extractions, evals, lookups etc? That will probably drive the approach you have to take, including if you want to keep the original category value around in some other field.

See the doc below which describes the search time operation sequence
http://docs.splunk.com/Documentation/Splunk/7.0.0/Knowledge/Searchtimeoperationssequence