It doesn't map the field aliases because the AWS app uses calculated fields to generate requestParameters.userName and calculated fields are processed after field aliasing in the search-time operation sequence. https://docs.splunk.com/Documentation/Splunk/8.0.2/Knowledge/Searchtimeoperationssequence I'm trying to do the same thing as you & having no luck. It seems to me that the AWS addon is CIM compliant in name only, the only thing populated are tags. It doesn't do much good when every other CIM field is "unknown". I'm beginning to wonder if trying to leverage the CIM is even worth it at this point.... ... View more