Splunk Search

Why is my field alias not recognized in a search?

corosco112
New Member

I created in props.conf:

FIELDALIAS-ipaddress = Asset IP Address AS ipaddress

Now in the search, I select my index and sourcetype and then | table ipaddress, but I get no results.

Asset IP Address is the name of the CSV field I input into Splunk. Do I need to do something else besides what I've already done?

Tags (4)
0 Karma

jeffland
SplunkTrust
SplunkTrust

Just like with any field name that has whitespaces in it, you'll have to enclose it in quotes. The following won't work on your system:

sourcetype=your_sourcetype | stats count by Asset IP Address

whereas this should work:

sourcetype=your_sourcetype | stats count by "Asset IP Address"

It's easy to see why: how should splunk know that you want to split by a field called <Asset IP Address>, and not split by the three fields <Asset>, <IP> and <Address>? You have to be specific here.
Same goes for your props.conf line, which has to be

FIELDALIAS-ipaddress = "Asset IP Address" AS ipaddress
0 Karma

renjith_nair
Legend

Is Asset IP Addres is an exiting field in your search (is it real one with space?)?

---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma
Get Updates on the Splunk Community!

Splunk Mobile: Your Brand-New Home Screen

Meet Your New Mobile Hub  Hello Splunk Community!  Staying connected to your data—no matter where you are—is ...

Introducing Value Insights (Beta): Understand the Business Impact your organization ...

Real progress on your strategic priorities starts with knowing the business outcomes your teams are delivering ...

Enterprise Security (ES) Essentials 8.3 is Now GA — Smarter Detections, Faster ...

As of today, Enterprise Security (ES) Essentials 8.3 is now generally available, helping SOC teams simplify ...