Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

Alias changes field result to multivalue

$
0
0
I created a simple alias in props.conf (FIELDALIAS-category = cat as category) which is working as expected. I have two fields cat and category and the fields have the same values. However cat is extracting correctly with the string being a single value. Whereas category is being broken at every whitespace creating a multivalue field. Line merge is set to true and I have tried adding EVAL-category = coalesce(category, cat) but no change. Any ideas? Did I miss something here?

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>