Module 8: Creating Field Aliases and Calculated Fields

Question 1

What are Field Aliases?

Answer 1

A way to normalize data over any default field (host, source or sourcetype)

Question 2

Can multiple aliases be applied to one field?

Answer 2

Yes they can

Question 3

When are Field Aliases applied?

Answer 3

After field extractions and before lookups

Question 4

Can you apply field aliases to lookups?

Answer 4

Yes you can

Question 5

What would you do if you had several source types containing some type of username field?

Answer 5

You would create a Field Alias to make data correlation and searching easier, normailze the field(s)

Question 6

How would you create a field alias?

Answer 6

• Settings
• Fields
• Field Aliases
• New Field Alias

Question 7

After opening up a new Field Alias what would you do to finish?

Answer 7

1. Select the app associated with the field alias
2. Enter a name for the field alias
3. Apply the field alias to a default field
   - host
   - source
   - sourcetype
4. Enter the name for the existing field and the new alias

Question 8

After you have created a field alias what should you do?

Answer 8

Test it! Perform a search using the new field alias

Question 9

When you create a new field alias is the original field affected?

Answer 9

No, the original field is not affected

- both fields appear in the all fields and interesting fields lists, if they appear in at least 20% of events

Question 10

After creating a field alias are you able to reference them in a lookup table?

Answer 10

Yes you can reference them in a lookup table

Question 11

What is a calculated field?

Answer 11

Is a shortcut for performing repetitive, long, or complex transformations using the eval command and it must be based on an extracted field

Question 12

What is not supported when using a calculated field?

Answer 12

Output fields from a lookup table or fields/columns generated from within a search string are not supported

Question 13

How would you create a calculated field?

Answer 13

• Settings
• Fields
• Calculated Fields
• New calculated Field

Question 14

After opening up a new calculated field what do you do next?

Answer 14

1. Select the app that will use the calculated field
2. Select host, source, or sourceytpe to apply to the calculated field and specify the related name
3. Name the calculated field
4. Define the eval expression

Question 15

What happens after you have created a calculated field?

Answer 15

You can use it in a search like any other extracted field