Splunk Search

Field alaises

Ephrem32
Explorer

my field aliases are set like this:

browser = BROWSER

referrer = REFERRER

req=REQ

req_id=REQ=ID

src=SRC

During my search in the csv that includes these field aliases: I get all of the results in my field except req=REQ. I only get req but not REQ. Why is that and how would I be able to fix this?

 

Thank you, 

 

Labels (2)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Ephrem32,

I think that "req_id=REQ=ID" it's probably an error in tis question, otherwise, check it because you're renaming REQ in ID.

Anyway, check the permissions in your aliases.

Ciao.

Giuseppe

0 Karma

Ephrem32
Explorer

My apologies that was the typo. I checked the permission its on Global and has the admin roles selected which is correct. I still do not get REQ in my interested fields in my search. Any other reasons? Thanks

@gcusello  

browser = BROWSER

referrer = REFERRER

req=REQ

req_id=REQ_ID

src=SRC

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Ephrem32,

could you share the content of you aliases?

you should have:

  • BROWSER AS browser
  • REFERRER AS referrer 
  • REQ AS req
  • REQ_ID AS req_id
  • SRC AS src

You can find them in [Settings -- Fields -- Aliases]

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Data Management Digest – November 2025

  Welcome to the inaugural edition of Data Management Digest! As your trusted partner in data innovation, the ...

Splunk Mobile: Your Brand-New Home Screen

Meet Your New Mobile Hub  Hello Splunk Community!  Staying connected to your data—no matter where you are—is ...

Introducing Value Insights (Beta): Understand the Business Impact your organization ...

Real progress on your strategic priorities starts with knowing the business outcomes your teams are delivering ...