Splunk Search

Problem with Fields Aliases

New Member

Hi all,
I have some problem with fields aliases.
I try to explain, I receive a message MQ with a XML message body; i'm able to retrieve every tag into the body.
Now I need to "map" two or more tag under the same alias, something like this:
alt text

If I search by single tag I found a lot of values, but when i try to search with alias I found only a few values (below an example).

alt text

As you can see values like 9781 or 9779 are always identified, the others values not.
I tried to modify or check or rewrite props/fields/transorm.conf, but I have always the same result.

Please I need some help, I don't know how to solve.

Thanks a lot.

Tags (1)
0 Karma

New Member

Hi Giuseppe,

with coalesce function I can retrieve all the values, thank you.
But I need to know if alias function works correctly, I need to do this type of function for a lot of fields so I could be much more "comfortable" use an alias.

My search it's simple:

index="index_name" | table _time,"ALIAS",CODE1,CODE2

It seems that alias does not "store" correctly one of the field.

Thanks a lot.

0 Karma


It's useful to have your search and results.
in the meantime did you tried with a calculated field using coalesce?

| eval ElaborationCode=coalesce(SLOGELAB,SPOSELAB)


0 Karma

Esteemed Legend

We are never going to understand unless you show the searches and the results that go with them.

0 Karma
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...