I should have thought of that (it has happened to me). You should "Accept" your answer to close the question. ... View more

It did work , however editing the conf file means there is no entry in the splunk web gui, so i've opted for the softlink approach. thanks again WC ... View more

The documentation says: Note: Splunk Enterprise's field aliasing functionality does not currently support multivalue fields. This probably also means that if your events have both fields, then kap_chk will only be set once to one of them (probably the first time and then the second alias will be thwarted by the fact that kap_chk already exists). But even if you can create a multi-value field with FIELDALIAS , It still will not work with the lookup; you will still have to pass the stream through mvexpand . If you need something "automatic-ish" then I suggest creating a macro out of my solution and then always calling the macro. ... View more

Thank you, The source key edit fixed it. ... View more

It was permissions error... as i thought.. .i just had to change the perm of every file in the app. ... View more