I have indexed few sample logs in to the Splunk..
2020-02-15T10:41:54.305Z servername.com sev="INFO" msgdetails="Audit success" polname="policy_name"
Splunk by default extract the fields sev, msgdetails, polname and extract the values appropriately. Everything loos good.
For me, i need to rename the field as severity instead of sev, Description instead of msgdetails and Policies instead of polname.
I have updated the props.conf
FIELDALIAS-severity = sev AS Severity
FIELDALIAS-msg_details = msg_details AS Description
FIELDALIAS-pol_name = pol_name AS Policies
Fields are extracting properly.
When i run the search on Verbose Mode, i can see both sev and Severity, which is quiet annoying for the Analysts
Is it normal or do i have to write a EXTRACT function with appropriate REGEX in order to show only the Severity field NOT sev.
Yes it's normal:
the only way to avoid to have both the field names is to insert a rename in all your searches.