Create field aliases in Splunk Web
In your data, you might have groups of events with related field values. To help you search for these groups of fields, you can assign field aliases to their field values.
Field aliases are an alternate name that you assign to a field allowing you to use that name to search for events that contain that field. A field can have multiple aliases, but a single alias can only apply to one field. For example, the field
vendor_action can be aliased to
message_type, but not both. An alias does not replace or remove the original field name.
Perform field aliasing after key-value extraction, but before field lookups, so that you can specify a lookup table based on a field alias. This can be helpful if one or more fields in the lookup table are identical to fields in your data, but have different names. See Configure CSV and external lookups and Configure KV store lookups.
For more information on aliases, see About tags and aliases.
Use field aliases to normalize your data
You can use Splunk Web to assign an alternate name to a field, allowing you to use that name to search for events that contain that field.
- See About tags and aliases for more information on aliases.
- Locate a field within your search that you would like to alias.
- Select Settings > Fields > Field aliases.
- Select an app to use the alias.
- Enter a name for the alias. Currently supported characters for alias names are a-z, A-Z, 0-9, or _.
- Select the host, source, or sourcetype to apply to a default field.
- Enter the name for the existing field and the new alias.
- Click Save.
View your new field alias in the Field Aliases page.
Tag event types
Configure field aliases with props.conf
This documentation applies to the following versions of Splunk® Enterprise: 7.0.0, 7.0.1, 7.0.2, 7.0.3, 7.0.4, 7.0.5, 7.0.6, 7.0.7, 7.0.8, 7.0.9, 7.1.0, 7.1.1, 7.1.2, 7.1.3, 7.1.4, 7.1.5, 7.1.6, 7.2.0, 7.2.1, 7.2.2, 7.2.3, 7.2.4