help on splunk field aliases not visible

[jip31]

hello

I have a admin role

when I create a field alias, I can see it in the props.conf file but when I run the search the field names are unchanged

[sourcetype="Perfmon:mem"]
FIELDALIAS-Value = Value AS titi counter AS tutu

what is wrong please?

[gcusello · Accepted solution]

Hi @jip31,

when you use sourcetype, you don't need to specify it;

[Perfmon:mem]
FIELDALIAS-Value = Value AS titi counter AS tutu

only for host and source you have to specify them but with a different syntax:

[source::your_source]
FIELDALIAS-Value = Value AS titi counter AS tutu

[host::your_host]
FIELDALIAS-Value = Value AS titi counter AS tutu

Ciao.

Giuseppe

[gcusello]

Hi @jip31 ,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉