<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: Overwrite App-default EVAL in props.conf with FieldAlias in Getting Data In</title>
    <link>https://community.splunk.com/t5/Getting-Data-In/Overwrite-App-default-EVAL-in-props-conf-with-FieldAlias/m-p/560070#M92595</link>
    <description>&lt;P&gt;Hi&amp;nbsp;&lt;a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/163730"&gt;@venkatasri&lt;/a&gt;&amp;nbsp;,&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;your solution worked for me.&amp;nbsp; Thanks &lt;span class="lia-unicode-emoji" title=":slightly_smiling_face:"&gt;🙂&lt;/span&gt;&lt;/P&gt;</description>
    <pubDate>Mon, 19 Jul 2021 14:32:03 GMT</pubDate>
    <dc:creator>Mockjin</dc:creator>
    <dc:date>2021-07-19T14:32:03Z</dc:date>
    <item>
      <title>Overwrite App-default EVAL in props.conf with FieldAlias</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/Overwrite-App-default-EVAL-in-props-conf-with-FieldAlias/m-p/559777#M92562</link>
      <description>&lt;P&gt;Hello *&lt;/P&gt;&lt;P&gt;how can i overwrite the default eval definition for field app in props.conf?&lt;/P&gt;&lt;P&gt;default/props.conf&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;LI-CODE lang="markup"&gt;...
EVAL-app = "Blue Coat ProxySG"
...&lt;/LI-CODE&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;I try to overwrite this field with following in local/props.conf&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;LI-CODE lang="markup"&gt;...
FIELDALIAS-app             = x_bluecoat_application_name as app
...&lt;/LI-CODE&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;We use a distributed Environment so i changed this in SH and HF app. But no change to the results.&lt;/P&gt;&lt;P&gt;What am i doing wrong?&lt;/P&gt;</description>
      <pubDate>Fri, 16 Jul 2021 08:17:49 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/Overwrite-App-default-EVAL-in-props-conf-with-FieldAlias/m-p/559777#M92562</guid>
      <dc:creator>Mockjin</dc:creator>
      <dc:date>2021-07-16T08:17:49Z</dc:date>
    </item>
    <item>
      <title>Re: Overwrite App-default EVAL in props.conf with FieldAlias</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/Overwrite-App-default-EVAL-in-props-conf-with-FieldAlias/m-p/559788#M92566</link>
      <description>&lt;P&gt;Hi&amp;nbsp;&lt;a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/232811"&gt;@Mockjin&lt;/a&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;As per precedence EVAL executes after FIELDALIAS hence though you created a alias as 'app' same is being overridden with EVAL-* expression in default/ dir.&lt;/P&gt;&lt;P&gt;Can you try this in local/props.conf and deploy the changes to SH and restart.&lt;/P&gt;&lt;LI-CODE lang="markup"&gt;EVAL-app = x_bluecoat_application_name&lt;/LI-CODE&gt;&lt;P&gt;----&lt;/P&gt;&lt;P&gt;An upvote would be appreciated and Accept solution if this reply helps !&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;</description>
      <pubDate>Fri, 16 Jul 2021 10:27:33 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/Overwrite-App-default-EVAL-in-props-conf-with-FieldAlias/m-p/559788#M92566</guid>
      <dc:creator>venkatasri</dc:creator>
      <dc:date>2021-07-16T10:27:33Z</dc:date>
    </item>
    <item>
      <title>Re: Overwrite App-default EVAL in props.conf with FieldAlias</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/Overwrite-App-default-EVAL-in-props-conf-with-FieldAlias/m-p/560070#M92595</link>
      <description>&lt;P&gt;Hi&amp;nbsp;&lt;a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/163730"&gt;@venkatasri&lt;/a&gt;&amp;nbsp;,&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;your solution worked for me.&amp;nbsp; Thanks &lt;span class="lia-unicode-emoji" title=":slightly_smiling_face:"&gt;🙂&lt;/span&gt;&lt;/P&gt;</description>
      <pubDate>Mon, 19 Jul 2021 14:32:03 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/Overwrite-App-default-EVAL-in-props-conf-with-FieldAlias/m-p/560070#M92595</guid>
      <dc:creator>Mockjin</dc:creator>
      <dc:date>2021-07-19T14:32:03Z</dc:date>
    </item>
  </channel>
</rss>

