Knowledge Management
Highlighted

Is it possible to create a field alias on a lookup output field for mapping to the CIM model?

Explorer

Hi guys,

I am in the midst of trying to map the fields in my data to the splunk authentication CIM. However, I realised that I don't seem able to create a field alias on lookup output fields (eg. Interfaces [lookup output field] => App [CIM field]) {ie This field aliases don't show up}. Is it possible to create a field alias for mapping my lookup output field to the CIM model, and if there isn't, could I kindly request for your suggestion as to what I can do to map my lookup fields to the CIM Model? Thanks and have a pleasant day/evening ahead 🙂

0 Karma
Highlighted

Re: Is it possible to create a field alias on a lookup output field for mapping to the CIM model?

Ultra Champion

You can do that straight in the lookup action, by writing the output side of the lookup as OUTPUT <output_field> AS <output_field_in_event>

View solution in original post

0 Karma
Highlighted

Re: Is it possible to create a field alias on a lookup output field for mapping to the CIM model?

Explorer

Guess I overlooked that. Thanks 🙂

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.