Configure field aliases with props.conf

In your data, you might have groups of events with related field values. To help you search for these groups of fields, you can assign field aliases to their field values. You can assign one or more tags to any extracted field, including event type, host, source, or source type.

Field aliases are an alternate name that you assign to a field, allowing you to use that name to search for events that contain that field. A field can have multiple aliases, but a single alias can only apply to one field. For example, the field vendor_action can be aliased to action or message_type, but not both. An alias does not replace or remove the original field name.

Don't create a field alias for a field with the same name as an internal field, such as _time. For example, if a field is called eventStartTime, don't name its field alias _time. Giving a field alias the same name as an internal field produces unpredictable search results.

Perform field aliasing after key-value extraction but before field lookups so that you can specify a lookup table based on a field alias. This can be helpful if one or more fields in the lookup table are identical to fields in your data, but are named differently. See Configure CSV and external lookups and Configure KV store lookups.

You can define aliases for fields that are extracted at index time as well as those that are extracted at search time.

Add your field aliases to props.conf, which you edit in $SPLUNK_HOME/etc/system/local/, or your own custom app directory in $SPLUNK_HOME/etc/apps/. Use the latter directory to make it easy to transfer your data customizations to other index servers.)

Splunk Enterprise supports single value fields only.

Use props.conf to configure field aliases

Prerequisities

• See about tags and aliases for more information on aliases.

Steps

1. Add the following line to a stanza in props.conf:

FIELDALIAS-<class> = <orig_field_name> AS <new_field_name>

• <orig_field_name> is the original name of the field.
• <new_field_name> is the alias to assign to the field.
• You can include multiple field alias renames in one stanza.
2. Restart Splunk Enterprise for your changes to take effect.

Example of field alias additions for a lookup

You created a lookup for an external static table CSV file, where the field you extracted at search time as ip is referred to as ipaddress. In the props.conf file where you defined the extraction, add a line that defines ipaddress as an alias for ip, as follows:

[accesslog]
EXTRACT-extract_ip = (?<ip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})
FIELDALIAS-extract_ip = ip AS ipaddress

When you set up the lookup in props.conf, use ipaddress where you would otherwise use ip:

[dns]
lookup_ip = dnsLookup ipaddress OUTPUT host

See Create and maintain search-time field extractions through configuration files.

See Introduction to lookup configuration and Configure KV store lookups.