Splunk Search

Problem with Fields Aliases

mcalta
New Member

Hi all,
I have some problem with fields aliases.
I try to explain, I receive a message MQ with a XML message body; i'm able to retrieve every tag into the body.
Now I need to "map" two or more tag under the same alias, something like this:
alt text

If I search by single tag I found a lot of values, but when i try to search with alias I found only a few values (below an example).

alt text

As you can see values like 9781 or 9779 are always identified, the others values not.
I tried to modify or check or rewrite props/fields/transorm.conf, but I have always the same result.

Please I need some help, I don't know how to solve.

Thanks a lot.

Tags (1)
0 Karma

mcalta
New Member

Hi Giuseppe,

with coalesce function I can retrieve all the values, thank you.
But I need to know if alias function works correctly, I need to do this type of function for a lot of fields so I could be much more "comfortable" use an alias.

My search it's simple:

index="index_name" | table _time,"ALIAS",CODE1,CODE2

It seems that alias does not "store" correctly one of the field.

Thanks a lot.
Marco

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi
It's useful to have your search and results.
in the meantime did you tried with a calculated field using coalesce?

| eval ElaborationCode=coalesce(SLOGELAB,SPOSELAB)

Bye.
Giuseppe

0 Karma

woodcock
Esteemed Legend

We are never going to understand unless you show the searches and the results that go with them.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...