topic Re: Why are mvindex and mvjoin not working while using eval to define calculated fields in props.conf? in Getting Data In

Why are mvindex and mvjoin not working while using eval to define calculated fields in props.conf?

tsawant — Mon, 09 Feb 2015 13:58:59 GMT

Here's a quick question I am trying to implement calculated fields in props.conf using EVAL command following is the code that I am trying to implement:

EVAL-PAYXLINE_MV2=mvindex(PAYXLINE_MV,N,-1) 
EVAL-PAYXLINEGLOB=mvjoin(PAYXLINE_MV2," ")
EVAL-PAYXHASH=sha256(mvjoin(PAYXLINE_MV," "))

The problem is I am not able to get the first 2 commands working when I put mvindex and mvjoin directly but it works perfectly fine when I use mvjoin with sha256. Can you help me to solve this problem. Here is the documentation that I am following to define fields in props.conf.
http://docs.splunk.com/Documentation/Splunk/6.2.1/Knowledge/definecalcfields

Re: Why are mvindex and mvjoin not working while using eval to define calculated fields in props.conf?

_d_ — Mon, 28 Sep 2020 18:55:16 GMT

Well, in your first two statements you're evaluating PAYXLINE_MV2 on the first and then calling it again on the second. Calculated fields are evaluated in parallel and not in sequence; i.e. PAYXLINE_MV2 is not availalbe to the 2nd statement when it tries to execute. Try something like this:

EVAL-PAYXLINEGLOB=mvjoin(mvindex(PAYXLINE_MV,N,-1)," ")

Re: Why are mvindex and mvjoin not working while using eval to define calculated fields in props.conf?

tsawant — Mon, 09 Feb 2015 15:58:28 GMT

Not working I tried doing that previously.

Re: Why are mvindex and mvjoin not working while using eval to define calculated fields in props.conf?

wpreston — Mon, 09 Feb 2015 16:02:14 GMT

Can you share your props.conf and transforms.conf lines for the PAYXLINE_MV field?

Re: Why are mvindex and mvjoin not working while using eval to define calculated fields in props.conf?

_d_ — Mon, 09 Feb 2015 16:15:17 GMT

That should work if 'PAYXLINE_MV' is indeed a multivalued field and 'N' is a number.

Re: Why are mvindex and mvjoin not working while using eval to define calculated fields in props.conf?

_d_ — Mon, 09 Feb 2015 16:32:13 GMT

In addition to being a number, N needs to be within the range of the length of the multivalued field.

Re: Why are mvindex and mvjoin not working while using eval to define calculated fields in props.conf?

tsawant — Mon, 09 Feb 2015 16:38:22 GMT

yea its a multivalued field and N is number

Re: Why are mvindex and mvjoin not working while using eval to define calculated fields in props.conf?

tsawant — Tue, 10 Feb 2015 17:01:57 GMT

mvjoin works perfectly in props.conf right ?

Re: Why are mvindex and mvjoin not working while using eval to define calculated fields in props.conf?

n00b — Fri, 10 Jun 2022 17:33:30 GMT

This comment about it happening in parallel vs in order fixed an issue I had for days!