We created a custom app for our Exchange message trace logs and I have the following field alias defined in the custom app's default/props.conf file on our Deployment server:
FIELDALIAS-org_user = src_user AS org_user
I reloaded the Deployment server and the verified the change made it to our Deployer and Cluster Master servers and from each server, pushed the bundle to the clustered SHs and clustered indexers. I then verified the change made it to all SHs and indexers.
In the GUI, I verified the permissions for the field alias is set to "All apps". When I run a generic search of the message trace logs, the field alias 'org_user' is not showing as a field.
Is there any other place I need to check to see why this field alias is not showing up in my searches?
One more thing: if you are using a non-current version of Splunk Enterprise Security and your app does not contain *_SA_* or *_TA_* then you need to modify the application whitelist to accept your custom application within the Enterprise Security app.