How to define field alias on extracted fields?

[sabaKhadivi]

I extracted some fields from raw log , and I want to define field alias for them , but on specific field which is used in other indexes and has field alias ,the alias doesn't work .

[PowerPacked · Accepted solution]

Hi

If you extracted those fields by eval, its not gonna work as there is a sequence in search time operations. - field alias comes before eval ( calculated fields)

Please take a look at this sequence of search time operation, which means every search ran in UI go through these operations in order.

https://docs.splunk.com/Documentation/Splunk/7.2.6/Knowledge/Searchtimeoperationssequence

Thanks

[sabaKhadivi]

Thanks for your answer, but I use inline extraction which is in the firest sequnece , that field alias work on some indexes and don't work on the others.

[PowerPacked]

Does that means you have Extract-classname in props of searchhead for above extracted fields?

Thanks

[sabaKhadivi]

yes exactly, the problem is solved ,it was related to host::* whitch cause conflict with other configuration by TAs. when I restrict host ,it just work!!!

[somesoni2]

The field alias is set at sourcetype/source/host level. Where have you setup your field alias and did you use correct sourcetype/source/host?

[sabaKhadivi]

I setted it up from field bar , and I default it based on host .