I am trying to map incoming events to CIM fields using aliases. I followed the documentation here —https://docs.splunk.com/Documentation/Splunk/7.1.3/Knowledge/Addaliasestofields— but it didn't work when I viewed the dataset's values. The docs don't even mention the "named" column so it makes me wonder if I"m doing it right. I tried to create an alias for CIM app and my src_ip custom field (created in the web.web dataset) to src. When I view the dataset values from the "datasets" tab, or search: | from datamodel:"Web.Web" , the src field value remains always as "unknown". I created the same alias for the search app and it didnt work either. What am I doing wrong? thanks ... View more