Splunk Search

Why is my field alias not recognized in a search?

corosco112
New Member

I created in props.conf:

FIELDALIAS-ipaddress = Asset IP Address AS ipaddress

Now in the search, I select my index and sourcetype and then | table ipaddress, but I get no results.

Asset IP Address is the name of the CSV field I input into Splunk. Do I need to do something else besides what I've already done?

Tags (4)
0 Karma

jeffland
SplunkTrust
SplunkTrust

Just like with any field name that has whitespaces in it, you'll have to enclose it in quotes. The following won't work on your system:

sourcetype=your_sourcetype | stats count by Asset IP Address

whereas this should work:

sourcetype=your_sourcetype | stats count by "Asset IP Address"

It's easy to see why: how should splunk know that you want to split by a field called <Asset IP Address>, and not split by the three fields <Asset>, <IP> and <Address>? You have to be specific here.
Same goes for your props.conf line, which has to be

FIELDALIAS-ipaddress = "Asset IP Address" AS ipaddress
0 Karma

renjith_nair
Legend

Is Asset IP Addres is an exiting field in your search (is it real one with space?)?

---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Wednesday, May 29, 2024  |  11AM PST / 2PM ESTRegister now and join us to learn more about how you can ...

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer Certification at ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...