Skip to content

Splunk Practice Exercise 11: Configuring Field Alias

Introduction

This practice exercise focuses on configuring field aliases in Splunk.

Step 1: Access Splunk Web

  1. Open your web browser and navigate to Splunk Web:

    http://<your server ip>:8000

  2. Log in using your credentials.

Step 2: Navigate to Settings

  1. In the Splunk Web interface, go to the Settings menu.

Step 3: Configure Field Alias

  1. Under Settings, select Fields.

  2. Click on Field Aliases.

  3. Click on New Field Alias.

  4. Enter a name to your liking for the field alias.

  5. Apply the alias to sourcetype vendor_sales.

  6. Set Field aliases to be VendorID = vendor_id. This will create a new field vendor_id while still keeping the original name.

  7. Click Save to create the field alias.

  1. Go back to the Search & Reporting app.

  2. Use the field alias in your search queries. For example:

Query:

index=tutorial | table VendorID, vendor_id

This should output 2 columns with different names but identical values as we just made an alias to the field.

Conclusion

Congratulations! You have successfully completed the practice exercise, configuring a field alias in Splunk. Field aliases are useful for simplifying and standardizing the names of fields in your searches and reports. Continue to explore and experiment with different configuration options to enhance your Splunk skills.