Splunk Search

Confusing behaviour of fieldalias

Communicator

I've have downloaded from Splunkbase and applied the Linux secure TA on my Splunk instance, and I've been facing with a strange issue I can't understand.

There are a couple fieldaliases defined in it:

FIELDALIAS-rhost = rhost AS srcip <<<<<<<<<<
FIELDALIAS-src
user = ruser AS srcuser
FIELDALIAS-app = process AS app
FIELDALIAS-vendor
product = process AS vendorproduct
FIELDALIAS-dest = host AS dest
FIELDALIAS-dest
host = host AS desthost
FIELDALIAS-dest
ntdomain = kerberosdomain AS destntdomain
FIELDALIAS-src = src_ip AS src <<<<<<<<<<<<<<

I've marked the problematic ones with the arrows.
So, srcip is created just as expected. However, src is not, just only in a really few number of events. Doing a quick spotcheck, I had like 25 different values in srcip, but only 2 in src.
My search looked like simply this:
index=ftp

Going forward, when I've selected a value from srcip, and run my search like this:
index=ftp src
ip=1.2.3.4

then the src field was created, and it had the 1.2.3.4 value in it. (previously, it was present in src_ip but not in src)

After this, I've created a new props.conf in the local folder of the TA, and added the following line:
FIELDALIAS-rhost = rhost AS srcip
FIELDALIAS-rhost
test= rhost AS src <<<<<<<

Now it works for 100% of the events, both src_ip and src is created with all the values.

I just can't understand what went wrong with the original configuration.
What am I missing ?

0 Karma
1 Solution

Champion

In your original configuration, you are trying to define a fieldalias src from the other fieldalias src_ip. That is no supported. All fieldalias operation happen in parallel, so you cannot have a dependency on one alias in the definition of another alias.

Your second version works because there is no dependency on src_ip in the definition of src.

View solution in original post

0 Karma

Splunk Employee
Splunk Employee

For a more in-depth explanation of the limitations of FIELDALIAS, please see my answer on https://answers.splunk.com/answers/657473/fieldalias-override-another-fieldalias.html?childToView=76...

0 Karma

Champion

In your original configuration, you are trying to define a fieldalias src from the other fieldalias src_ip. That is no supported. All fieldalias operation happen in parallel, so you cannot have a dependency on one alias in the definition of another alias.

Your second version works because there is no dependency on src_ip in the definition of src.

View solution in original post

0 Karma