Splunk Search

Confusing behaviour of fieldalias

szabados
Communicator

I've have downloaded from Splunkbase and applied the Linux secure TA on my Splunk instance, and I've been facing with a strange issue I can't understand.

There are a couple fieldaliases defined in it:

FIELDALIAS-rhost = rhost AS src_ip <<<<<<<<<<
FIELDALIAS-src_user = ruser AS src_user
FIELDALIAS-app = process AS app
FIELDALIAS-vendor_product = process AS vendor_product
FIELDALIAS-dest = host AS dest
FIELDALIAS-dest_host = host AS dest_host
FIELDALIAS-dest_nt_domain = kerberos_domain AS dest_nt_domain
FIELDALIAS-src = src_ip AS src <<<<<<<<<<<<<<

I've marked the problematic ones with the arrows.
So, src_ip is created just as expected. However, src is not, just only in a really few number of events. Doing a quick spotcheck, I had like 25 different values in src_ip, but only 2 in src.
My search looked like simply this:
index=ftp

Going forward, when I've selected a value from src_ip, and run my search like this:
index=ftp src_ip=1.2.3.4

then the src field was created, and it had the 1.2.3.4 value in it. (previously, it was present in src_ip but not in src)

After this, I've created a new props.conf in the local folder of the TA, and added the following line:
FIELDALIAS-rhost = rhost AS src_ip
FIELDALIAS-rhost_test= rhost AS src <<<<<<<

Now it works for 100% of the events, both src_ip and src is created with all the values.

I just can't understand what went wrong with the original configuration.
What am I missing ?

0 Karma
1 Solution

rjthibod
Champion

In your original configuration, you are trying to define a fieldalias src from the other fieldalias src_ip. That is no supported. All fieldalias operation happen in parallel, so you cannot have a dependency on one alias in the definition of another alias.

Your second version works because there is no dependency on src_ip in the definition of src.

View solution in original post

0 Karma

lwest_splunk
Splunk Employee
Splunk Employee

For a more in-depth explanation of the limitations of FIELDALIAS, please see my answer on https://answers.splunk.com/answers/657473/fieldalias-override-another-fieldalias.html?childToView=76...

0 Karma

rjthibod
Champion

In your original configuration, you are trying to define a fieldalias src from the other fieldalias src_ip. That is no supported. All fieldalias operation happen in parallel, so you cannot have a dependency on one alias in the definition of another alias.

Your second version works because there is no dependency on src_ip in the definition of src.

0 Karma
Get Updates on the Splunk Community!

New Splunk Observability innovations: Deeper visibility and smarter alerting to ...

You asked, we delivered. Splunk Observability Cloud has several new innovations giving you deeper visibility ...

Synthetic Monitoring: Not your Grandma’s Polyester! Tech Talk: DevOps Edition

Register today and join TekStream on Tuesday, February 28 at 11am PT/2pm ET for a demonstration of Splunk ...

Instrumenting Java Websocket Messaging

Instrumenting Java Websocket MessagingThis article is a code-based discussion of passing OpenTelemetry trace ...