We created a custom app for our Exchange message trace logs and I have the following field alias defined in the custom app's default/props.conf file on our Deployment server:
FIELDALIAS-org_user = src_user AS org_user
I reloaded the Deployment server and the verified the change made it to our Deployer and Cluster Master servers and from each server, pushed the bundle to the clustered SHs and clustered indexers. I then verified the change made it to all SHs and indexers.
In the GUI, I verified the permissions for the field alias is set to "All apps". When I run a generic search of the message trace logs, the field alias 'org_user' is not showing as a field.
Is there any other place I need to check to see why this field alias is not showing up in my searches?
You need to check the
order of operations:
This says that either a
calculated field or an
automatic lookup could be overwriting your field alias. If the value is
null, I would suspect an
automatic lookup because a
calculated field would probably result in a
non-null value (but not necessarily).
One more thing: if you are using a non-current version of Splunk
Enterprise Security and your app does not contain
*_TA_* then you need to modify the
application whitelist to accept your custom application within the
Enterprise Security app.
Check like this:
|rest/servicesNS/-/-/data/props/fieldaliases | search type="FIELDALIAS" | table attribute stanza eai:acl.app value
Maybe add this, too:
| search 'eai:acl.app' = <Your App Name Here>