Check the TA default configs or anything else for field aliases or evals that have the same name i.e. FIELDALIAS-user and EVAL-user in props or GUI. Either remove the duplicate field alias or eval, or rename them like FIELDALIAS-userTest and see if the new field pops up. I know the Crowdstrike TA 3.1.6 has duplicate names for user and severity which causes Splunk to drop the alias or eval altogether ... View more