topic Re: What is the syntax for |makemv delim="|" when writing it in the props.conf file? in Getting Data In

What is the syntax for |makemv delim="|" when writing it in the props.conf file?

Yepeza — Fri, 09 Dec 2016 21:13:58 GMT

This works in the search bar |makemv delim="|", but not when I put that in the props.conf file.

Re: What is the syntax for |makemv delim="|" when writing it in the props.conf file?

somesoni2 — Fri, 09 Dec 2016 22:06:18 GMT

Try setting up calculated field with split command.

http://docs.splunk.com/Documentation/Splunk/6.5.1/Knowledge/definecalcfields

e.g.

props.conf

[yoursourcetype]
EVAL-YourFieldName = split(YourFieldName,"|")

Re: What is the syntax for |makemv delim="|" when writing it in the props.conf file?

Yepeza — Fri, 09 Dec 2016 22:20:40 GMT

I followed the syntax and it didn't work but does work in the search bar but i guess the .conf syntax is wrong?

Re: What is the syntax for |makemv delim="|" when writing it in the props.conf file?

somesoni2 — Fri, 09 Dec 2016 22:38:33 GMT

Did you restart Splunk after you added this in props.conf? Did you create a local.meta entry for this? May be try adding this from Settings->Fields -> Calculated fields.

Re: What is the syntax for |makemv delim="|" when writing it in the props.conf file?

Yepeza — Mon, 12 Dec 2016 17:14:35 GMT

Yes I restarted splunk after adding it to the props.conf and it still didn't work. I am not sure what the local.meta entry would be or used?

different variations I have tried:
EVAL-YourFieldName = split(YourFieldName,"|")
EVAL-YourFieldName YourFieldName = split(YourFieldName,"|")
EVAL-YourFieldName = YourFieldName = split(YourFieldName,"|")

Maybe an extra set of qoutes may do it

Re: What is the syntax for |makemv delim="|" when writing it in the props.conf file?

somesoni2 — Mon, 12 Dec 2016 17:21:22 GMT

Can you try creating this from Splunk Web UI? (Settings->Fields ->Calculated fields)

I hope you're creating these props.conf on the Search Head server.
Only the validation 1 is valid.

Re: What is the syntax for |makemv delim="|" when writing it in the props.conf file?

Yepeza — Mon, 12 Dec 2016 21:40:57 GMT

yes as the props.conf has other stanzas which work fine.... just want to add the eval split command. And the UI didn't work either... there has to be some documentation on the syntax used in .conf files for calculated commands.

Re: What is the syntax for |makemv delim="|" when writing it in the props.conf file?

somesoni2 — Mon, 12 Dec 2016 21:49:27 GMT

The syntax is available in the link that I provided (and also in the props.conf specification). Did you get any error while creating it from UI OR it just didn't work? After you created from UI, there should be props.conf entry created for that calculated field, could you provide that here? (check props.conf on the local folder under current app context).

Re: What is the syntax for |makemv delim="|" when writing it in the props.conf file?

Yepeza — Mon, 12 Dec 2016 22:00:44 GMT

it is.... EVAL- = split(,"|") is the entry in the props.conf file after I created it in from the UI and didn't work.... I also have field alias and lookups in the props.conf file

Re: What is the syntax for |makemv delim="|" when writing it in the props.conf file?

beatus — Tue, 13 Dec 2016 17:53:47 GMT

This sounds like a use case for fields.conf.

[myfield]
TOKENIZER = ([^\|]+)\|?

Re: What is the syntax for |makemv delim="|" when writing it in the props.conf file?

Yepeza — Tue, 13 Dec 2016 18:50:20 GMT

Figured out why it isn't working. The props.conf documentation states:

"Splunk processes calculated fields after field extraction and field
aliasing but before lookups. This means that:
* You can use a field alias in the eval statement for a calculated
field.
* You cannot use a field added through a lookup in an eval statement for a
calculated field."

and my input within my EVAL command was set by a lookup. So thats the reason it doesn't work 😕

Re: What is the syntax for |makemv delim="|" when writing it in the props.conf file?

Yepeza — Tue, 13 Dec 2016 19:51:49 GMT

it worked. Thanks! I created the fields.conf and hex works as well.
[myfield]
TOKENIZER = ([^\x7c]+)

Re: What is the syntax for |makemv delim="|" when writing it in the props.conf file?

Yepeza — Wed, 14 Dec 2016 14:28:53 GMT

Figured out why it isn't working. The props.conf documentation states:

"Splunk processes calculated fields after field extraction and field
aliasing but before lookups. This means that:
You can use a field alias in the eval statement for a calculated
field.
You cannot use a field added through a lookup in an eval statement for a
calculated field."

Had to create fields.conf. Details in accepted answer below.

Re: What is the syntax for |makemv delim="|" when writing it in the props.conf file?

beatus — Wed, 14 Dec 2016 15:11:40 GMT

Glad it worked! You can also use a tokenizer in |makemv to test before putting the configs in place.