Why is Field Alias not applying?

[joshuasolman]

Hey all, 

When i run a search like this: 

index=crowdstrike_pci sourcetype=crowdstrike:events:sensor event_simpleName=FileIntegrityMonitorRuleMatched | rename CommandLine AS process ContextTimeStamp AS file_access_time ImageFileName AS file_path ObjectName AS file_name ParentBaseFileName AS parent_process_exec ParentBaseFileName AS parent_process_name ParentCommandLine AS parent_process ParentImageFileName AS parent_process_path ParentProcessId AS parent_process_id RawProcessId AS process_id SHA256HashData AS file_hash UserName AS user aip AS dest event_platform AS os

The fields populate correctly, but when i hit up the Field Alias settings in the GUI to make them permanent, they dont appear in the search. Permissions are set for everyone to read all, and for sc_admin to write them. Its Splunk Cloud so i dont have access to the props.conf unless i upload one myself, but the field alias works for other sourcetypes, just not this one. 

Any ideas?

[dannymcdonald]

Check the TA default configs or anything else for field aliases or evals that have the same name i.e. FIELDALIAS-user and EVAL-user in props or GUI. Either remove the duplicate field alias or eval, or rename them like FIELDALIAS-userTest and see if the new field pops up. I know the Crowdstrike TA 3.1.6 has duplicate names for user and severity which causes Splunk to drop the alias or eval altogether