Field aliases are used to normalize different field names that contain the same type of data (like IP addresses) across multiple sourcetypes or sources, making the data CIM compliant without re-extracting the fields.
[Reference:, Splunk Power User Study Guide, CIM Compliance, Splunk Docs: Field Aliases for CIM, "Field aliases normalize field names across data sources for CIM compliance.", , , , , ]
Submit