Splunk Search

Why is my field alias not recognized in a search?

corosco112
New Member

I created in props.conf:

FIELDALIAS-ipaddress = Asset IP Address AS ipaddress

Now in the search, I select my index and sourcetype and then | table ipaddress, but I get no results.

Asset IP Address is the name of the CSV field I input into Splunk. Do I need to do something else besides what I've already done?

Tags (4)
0 Karma

jeffland
SplunkTrust
SplunkTrust

Just like with any field name that has whitespaces in it, you'll have to enclose it in quotes. The following won't work on your system:

sourcetype=your_sourcetype | stats count by Asset IP Address

whereas this should work:

sourcetype=your_sourcetype | stats count by "Asset IP Address"

It's easy to see why: how should splunk know that you want to split by a field called <Asset IP Address>, and not split by the three fields <Asset>, <IP> and <Address>? You have to be specific here.
Same goes for your props.conf line, which has to be

FIELDALIAS-ipaddress = "Asset IP Address" AS ipaddress
0 Karma

renjith_nair
Legend

Is Asset IP Addres is an exiting field in your search (is it real one with space?)?

Happy Splunking!
0 Karma
Get Updates on the Splunk Community!

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...

Updated Team Landing Page in Splunk Observability

We’re making some changes to the team landing page in Splunk Observability, based on your feedback. The ...