Can I use a IF\ElSE in a props.conf?

pfabrizi — Fri, 12 Jan 2018 14:02:16 GMT

Can I use IF\ELSE in a PROPS.conf? What does the syntax look like.

basically we want to do a if this eventid then do this else do this.

can I nest them.

Re: Can I use a IF\ElSE in a props.conf?

mayurr98 — Fri, 12 Jan 2018 14:09:46 GMT

hey yes you can do!!

Calculated fields with props.conf example

This example examines earthquake data and classifies quakes by their depth by creating a Description field:

source=eqs7day-M1.csv | eval Description=case(Depth<=70, "Shallow", Depth>70 AND Depth<=300, "Mid", Depth>300 AND Depth<=700, "Deep") | table Datetime, Region, Depth, Description

Steps
Using calculated fields, you could define the eval expression for the Description field in props.conf.

Create the following stanza in props.conf.

<Stanza> Eval-Description = case(Depth<=70, "Shallow", Depth>70 AND Depth<=300, "Mid", Depth>300 AND Depth<=700, "Deep")

2 . Rewrite the search as:

source=eqs7day-M1.csv | table Datetime, Region, Depth, Description

You can now search on Description as if it is any other extracted field. Splunk software will find the calculated field key and evaluate it for every event that contains a Depth field. You can also run searches like this:

source=eqs7day-M1.csv Description=Deep

Refer this link for more it is the same
https://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Configurecalculatedfieldswithprops.conf

let me know if this helps!

topic Can I use a IF\ElSE in a props.conf? in Knowledge Management

Can I use a IF\ElSE in a props.conf?

Re: Can I use a IF\ElSE in a props.conf?