Field Alias Applied to Hostname - Events Matched But No Results?

[kbarton]

Hi,

I am new to Splunk so please forgive me.

I had created a field field, where if the hostname contains "*-us*" then region=NA.

In search, I enter the query region=NA and I see thousands of events matched, but there are no results in the current time range. I am hoping for assistance with understanding why this is, or if I am going about this the incorrect way.

Thank you in advance.

[bowesmana]

How did you create the field - in the data or as a calculated field using an eval statement or did you really create an 'alias' field?  You cannot make a Splunk alias field that does what you are trying to do.

If you run the search

your_search region=NA
| table hostname region

what do your hostnames and regions look like?

Please show how you created the region field

[kbarton]

Hi,

Thanks for your response. I went into settings->Fields->Field Aliases->New Field Alias:

Destination app: search

Name: region NA

Apply to: host, named: *-us*

Field aliases: region=NA

The query that you had provided does not display any results.

[bowesmana]

Seems like you've gone down the wrong path.  An alias is there to so that if you have a field called host, you want to have another field called my_alias_for_host that has the same value as host, but which is just a new name to access the value of host.

What you want is to have a calculated field, which has an eval condition that populates a NEW field called region that is set to NA ONLY if the value of the other field host (not hostname?) does not contain the text

-us

I am assuming you want your wildcard * characters to assume anything before or after -us

So, create a new calculated field called region, apply it to the dataset you want it to be calculated for and make the eval statement

if(match(host, "-us"), "NA", "Value_for_Region_if_NOT_US")

Note that "Apply to: host" is NOT the right option here, you probably want to apply it to a source or sourcetype that contains the type of data you are dealing with