Knowledge Management

Why a cloned field alias does not work as the original despite having identical permissions and app context?

att35
Builder

Hi,

Trying to map fields from eStreamer data to the ones needed by IDS data model. One of the fields which comes from Sourcefire is "priority" for which there is an existing field alias ( priority -> severity_id), which works fine.

Since CIM needs the field name to be 'severity', I cloned another field alias ( priority -> severity) from the existing and made sure that it has global permission and is part of the TA for sourcefire, same as the field alias for "severity_id".

Still, only severity_id is working but not the one newly created for "severity". Also tried creating the same on indexer but it didn't work. Here is a screenshot showing both the aliases.

alt text

Please advise.

Thanks,

0 Karma

neelamsantosh
Path Finder

check the props and make sure Field alias is happening only after the Fields extraction

cmd:
/opt/splunk/bin/splunk cmd btool props list --debug|grep

0 Karma

dsrvern
Explorer

Hi abhijittikekar,

I'm also experiencing problems with field aliases. Did you ever find a solution to this issue?

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...