topic Re: Calculated field configuration (EVAL) not working in props.conf in Getting Data In

Calculated field configuration (EVAL) not working in props.conf

513239 — Tue, 29 Sep 2020 12:51:53 GMT

I am trying to use a filed in calculated fields from props.conf to replace space in one of my field values but not getting any results in Splunk 6.2.

Below is EVAL stanza from props.conf -

EVAL-Customer_Id_New=replace(Customer_Id," ","")

Not getting any new field "Customer_Id_New" in interesting field for that sourcetype. Please help me if you can.

Thanks in advance

Re: Calculated field configuration (EVAL) not working in props.conf

martin_mueller — Wed, 15 Feb 2017 12:47:04 GMT

Make sure the Customer_Id field is actually present at the time calculated fields are executed, and that it's not a calculated field itself.

Sequence reference: http://docs.splunk.com/Documentation/Splunk/6.5.2/Knowledge/Searchtimeoperationssequence#Search-time_operation_sequence

Re: Calculated field configuration (EVAL) not working in props.conf

513239 — Thu, 16 Feb 2017 09:35:57 GMT

Yes. Customer_Id field is present at the time calculated fields are executed, and it's not a calculated field.

Re: Calculated field configuration (EVAL) not working in props.conf

martin_mueller — Thu, 16 Feb 2017 09:49:55 GMT

More common errors to check:

Are you in the right app/user context?
Is the calculated field defined for the right sourcetype, source, or host?

Re: Calculated field configuration (EVAL) not working in props.conf

anantdeshpande — Fri, 17 Feb 2017 02:16:28 GMT

Hi, I have similar problem when entered from backed in props.conf. However calculated field works when wrote eval from GUI front end.

But after restart of the splunk instances also, i do not see any entry added in that sourcetype stanza.
New field always appears.

Question is where does splunk keeps entry of calculated fields?

Re: Calculated field configuration (EVAL) not working in props.conf

martin_mueller — Fri, 17 Feb 2017 08:15:06 GMT

If you added a knowledge object through the UI it is by default stored in your user context, etc/users/name/appname/local/props.conf - to move it to the app context etc/apps/appname/local/props.conf you need to share the knowledge object within the app.

Re: Calculated field configuration (EVAL) not working in props.conf

arunsunny — Tue, 11 Feb 2020 07:54:37 GMT

@martin_mueller - I have a question on declaring calculated field names with spaces?

For Example:
EVAL-Cricket Team Name=team_name

Will this work?

Re: Calculated field configuration (EVAL) not working in props.conf

martin_mueller — Tue, 11 Feb 2020 08:27:31 GMT

Sounds like a new question, so please create one. While you do that, also test if your calcfield works.