Knowledge Manager Manual

Create aliases for fields

You can create multiple aliases for a field. The original field is not removed. This process enables you to search for the original field using any of its aliases.

Important: Field aliasing is performed after key/value extraction but before field lookups. Therefore, you can specify a lookup table based on a field alias. This can be helpful if there are one or more fields in the lookup table that are identical to fields in your data, but have been named differently. For more information read "Configure field lookups" in this manual.

You can define aliases for fields that are extracted at index time as well as those that are extracted at search time.

You add your field aliases to props.conf, which you edit in $SPLUNK_HOME/etc/system/local/, or your own custom app directory in $SPLUNK_HOME/etc/apps/. (We recommend using the latter directory if you want to make it easy to transfer your data customizations to other index servers.)

Note: Splunk Enterprise's field aliasing functionality does not currently support multivalue fields.

To alias fields:

1. Add the following line to a stanza in props.conf:

FIELDALIAS-<class> = <orig_field_name> AS <new_field_name>

• <orig_field_name> is the original name of the field.
• <new_field_name> is the alias to assign to the field.
• You can include multiple field alias renames in one stanza.

2. Restart Splunk Enterprise for your changes to take effect.

Example of field alias additions for a lookup

Say you're creating a lookup for an external static table CSV file where the field you've extracted at search time as "ip" is referred to as "ipaddress." In the props.conf file where you've defined the extraction, you would add a line that defines "ipaddress" as an alias for "ip," as follows:

[accesslog]
EXTRACT-extract_ip = (?<ip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})
FIELDALIAS-extract_ip = ip AS ipaddress

When you set up the lookup in props.conf, you can just use ipaddress where you'd otherwise have used ip:

[dns]
lookup_ip = dnsLookup ipaddress OUTPUT host

For more information about search time field extraction, see "Add fields at search time" in this manual.

For more information about field lookups, see "Configure field lookups" in this manual.