Splunk Cloud

Knowledge Manager Manual

Download manual as PDF

This documentation does not apply to the most recent version of SplunkCloud. Click here for the latest version.
Download topic as PDF

Create field aliases in Splunk Web

In your data, you might have groups of events with related field values. To help you search for these groups of fields, you can assign field aliases to their field values.

Field aliases are an alternate name that you assign to a field allowing you to use that name to search for events that contain that field. A field can have multiple aliases, but a single alias can only apply to one field. For example, the field vendor_action can be aliased to action or message_type, but not both. An alias does not replace or remove the original field name.

Perform field aliasing after key-value extraction, but before field lookups, so that you can specify a lookup table based on a field alias. This can be helpful if one or more fields in the lookup table are identical to fields in your data, but have different names. See Configure CSV and external lookups and Configure KV store lookups.

For more information on aliases, see About tags and aliases.

Where field aliases fit in the search-time sequence of operations

When you run a search, Splunk software runs several operations to derive various knowledge objects and apply them to the events returned by the search. Splunk software applies field aliases to a search after it performs key-value field extraction, but before it processes calculated fields, lookups, event types, and tags.

This means that you can create aliases for fields that are extracted at index time or search time, but you cannot create aliases for calculated fields, event types, tags, or fields that are added to your events by a lookup.

On the other hand, you can reference field aliases in the configurations for search-time operations that follow the field aliasing process. For example, you can design a lookup table that is based on a field alias. You might do this if one or more fields in the lookup table are identical to fields in your data but have different names.

See The sequence of search-time operations.

Create a field alias with Splunk Web

You can use Splunk Web to assign an alternate name to a field, allowing you to use that name to search for events that contain that field.

Prerequisites

Steps

  1. Locate a field within your search that you would like to alias.
  2. Select Settings > Fields > Field aliases.
  3. (Required) Select an app to use the alias.
  4. (Required) Enter a name for the alias. Currently supported characters for alias names are a-z, A-Z, 0-9, or _.
  5. (Required) Select the host, source, or sourcetype to apply to a default field.
  6. (Required) Enter the name for the existing field and the new alias.
  7. Click Save.

View your new field alias on the Field Aliases page.

If you must associate a single alias field name with multiple original field names

You should not design field alias configurations that apply a single alias field name to multiple original field names. If you must do this, set the field alias up as a calculated field that uses the coalesce function to create a new field that takes the value of one or more existing fields. This method lets you be explicit about ordering of input field values in the case of NULL fields. For example: EVAL-ip = coalesce(clientip,ipaddress).

PREVIOUS
Tag event types
  NEXT
Configure field aliases with props.conf

This documentation applies to the following versions of Splunk Cloud: 7.2.4, 7.0.11, 7.0.0, 7.0.2, 7.0.3, 7.0.5, 7.0.8, 7.1.3, 7.1.6, 7.2.3


Comments

Can you please specify which is the new alias and which is the existing field in the X=Y ? This always confuses me and the GUI does not provide guidance

Davebo1896
March 13, 2019

Also, a single alias definition cannot get around the limitation of one alias per field name by doing: a1 as a2, a2 as a3 The GUI will allow the definition to be created (unlike the more direct a1 as a2, a1 as a3) but the field name a3 will not appear at search time with that approach; two definitions are required (1 for each) for success.

Landen99
January 24, 2019

Regarding "A field can have multiple aliases, but a single alias can only apply to one field." It should be noted that a single alias definition can only alias each field once, but separate alias definitions can alias the same fields in other alias definitions again only once. So to "copy"/alias a field to three new field names, three alias definitions are required.

It is similar in effect to the SPL function eval command f1=f2, except that multiple aliases on the same field names (f1) can be done in the same pipe. Also, the SPL function "rename" does not preserve the original field name but can merge several fields into a single field name only if done within the same pipe.

Landen99
January 24, 2019

Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters