topic Re: props.conf not showing the output using EVAL in Splunk Enterprise

props.conf not showing the output using EVAL

sureshkumaar — Thu, 20 Nov 2025 21:17:27 GMT

Below is props.conf for a sourcetype, where we getting results for raw_action and tag1 fields.

But considering/based upon the inputs received from raw_action and tag1 while we try to get the result for the field "action" receiving BLANK results.

Kindly someone help

Re: props.conf not showing the output using EVAL

livehybrid — Thu, 20 Nov 2025 10:21:32 GMT

Hi @sureshkumaar

You cannot reference a field generated by an EVAL statement (like tag1) inside another EVAL statement (like action) within the same props.conf stanza. All EVAL statements in a stanza run effectively in parallel based on the extracted fields, not sequentially based on each other's output.

To fix this, remove the dependency on tag1 inside EVAL-action and rely solely on raw_action. Since raw_action is extracted via EXTRACT (which runs before EVAL), it is available for use. (See https://help.splunk.com/en/splunk-enterprise/manage-knowledge-objects/knowledge-management-manual/10.0/get-started-with-knowledge-objects/the-sequence-of-search-time-operations)

Additionally, there is a typo in your original EVAL-action regex: dnf-makecache.service:Succeeded is missing the space that exists in EVAL-tag1 (dnf-makecache.service: Succeeded).

Try this:

🌟 Did this answer help you? If so, please consider:

Adding karma to show it was useful
Marking it as the solution if it resolved your issue
Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

Re: props.conf not showing the output using EVAL

PickleRick — Thu, 20 Nov 2025 19:10:07 GMT

https://help.splunk.com/en/splunk-enterprise/manage-knowledge-objects/knowledge-management-manual/9.4/get-started-with-knowledge-objects/the-sequence-of-search-time-operations#ariaid-title9

Restrictions

All EVAL-<fieldname> configurations within a single props.conf stanza are processed in parallel instead of sequentially. This means you can't chain together calculated field expressions where the evaluation of one calculated field is used in the expression for the next calculated field.