Alias not working when running a search

mwdbhyat · ‎02-08-2018

Hi there,

I have multiple fields being extracted and aliased. These all work fine if i search by index & sourcetype. As soon as I try to use stats or table them all, the rows come up empty for the fields using the alias. Any thoughts on why this happens?

Thanks!

utk123 · ‎02-11-2018

share some sample search commands to review what's wrong.

Alias not working when running a search

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Event Series: Level up your SOC: Advancing with Splunk Enterprise Security

Announcing Modern Navigation: A New Era of Splunk User Experience

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

Join the Conversation

Alias not working when running a search

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Event Series: Level up your SOC: Advancing with Splunk Enterprise Security

Announcing Modern Navigation: A New Era of Splunk User Experience

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry