Splunk Search

Field alias does not work in tstats?

phoenix_down
Path Finder

Hi all, I'm changing a field name in my index, so I'm trying to set up a field alias so both the old field name and new field name can be used in queries. This is for backward compatibility reasons, since a lot of existing dashboards/reports (many I do not own) refer to this field.

So I set up the field alias, and I find that the field alias works for a normal search (non-tstats), but does not work for tstats.  Does that mean field aliases do not work for tstats at all?

Labels (2)
Tags (1)
0 Karma

PickleRick
SplunkTrust
SplunkTrust

I wouldn't be surprised. Remember that tstats work on indexed fields.
fields.conf don't allow for field aliases as far as I remember.

Get Updates on the Splunk Community!

Index This | What’s a riddle wrapped in an enigma?

September 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

BORE at .conf25

Boss Of Regular Expression (BORE) was an interactive session run again this year at .conf25 by the brilliant ...

OpenTelemetry for Legacy Apps? Yes, You Can!

This article is a follow-up to my previous article posted on the OpenTelemetry Blog, "Your Critical Legacy App ...