Module 8: Creating Field Aliases and Calculated Fields Flashcards
What are Field Aliases?
A way to normalize data over any default field (host, source or sourcetype)
Can multiple aliases be applied to one field?
Yes they can
When are Field Aliases applied?
After field extractions and before lookups
Can you apply field aliases to lookups?
Yes you can
What would you do if you had several source types containing some type of username field?
You would create a Field Alias to make data correlation and searching easier, normailze the field(s)
How would you create a field alias?
- Settings
- Fields
- Field Aliases
- New Field Alias
After opening up a new Field Alias what would you do to finish?
- Select the app associated with the field alias
- Enter a name for the field alias
- Apply the field alias to a default field
- host
- source
- sourcetype - Enter the name for the existing field and the new alias
After you have created a field alias what should you do?
Test it! Perform a search using the new field alias
When you create a new field alias is the original field affected?
No, the original field is not affected
- both fields appear in the all fields and interesting fields lists, if they appear in at least 20% of events
After creating a field alias are you able to reference them in a lookup table?
Yes you can reference them in a lookup table
What is a calculated field?
Is a shortcut for performing repetitive, long, or complex transformations using the eval command and it must be based on an extracted field
What is not supported when using a calculated field?
Output fields from a lookup table or fields/columns generated from within a search string are not supported
How would you create a calculated field?
- Settings
- Fields
- Calculated Fields
- New calculated Field
After opening up a new calculated field what do you do next?
- Select the app that will use the calculated field
- Select host, source, or sourceytpe to apply to the calculated field and specify the related name
- Name the calculated field
- Define the eval expression
What happens after you have created a calculated field?
You can use it in a search like any other extracted field