https://community.splunk.com/t5/Knowledge-Management/Is-there-an-error-in-the-quot-Creating-Splunk-Knowledge-Objects/m-p/233107#M7928 <P>I believe you are correct. The video is incorrect as eval occurs before lookups so that you can use the evaluated field in the lookup.</P> Fri, 06 May 2016 13:15:56 GMT jkat54 2016-05-06T13:15:56Z https://community.splunk.com/t5/Knowledge-Management/Is-there-an-error-in-the-quot-Creating-Splunk-Knowledge-Objects/m-p/233106#M7927 <P>Hello,</P> <P>I am currently following the "Creating Splunk Knowledge Objects" eLearning course but at one point, the teacher says:</P> <P>"Calculated fields are evaluated after lookup are defined."</P> <P>It is also written in red on the video.<BR /> This is situated at the "2- Aliases and Calc Fields" module --&gt; "Manage Calc. Fields" --&gt; 00:20 seconds.<BR /> And so the teacher insists that Calculated fields are not usable with lookup, but...</P> <P>The props.conf documentation says something else:</P> <P>"Splunk processes calculated fields after field extraction and field aliasing but before lookups"</P> Fri, 06 May 2016 10:54:29 GMT https://community.splunk.com/t5/Knowledge-Management/Is-there-an-error-in-the-quot-Creating-Splunk-Knowledge-Objects/m-p/233106#M7927 ctaf 2016-05-06T10:54:29Z https://community.splunk.com/t5/Knowledge-Management/Is-there-an-error-in-the-quot-Creating-Splunk-Knowledge-Objects/m-p/233107#M7928 <P>I believe you are correct. The video is incorrect as eval occurs before lookups so that you can use the evaluated field in the lookup.</P> Fri, 06 May 2016 13:15:56 GMT https://community.splunk.com/t5/Knowledge-Management/Is-there-an-error-in-the-quot-Creating-Splunk-Knowledge-Objects/m-p/233107#M7928 jkat54 2016-05-06T13:15:56Z https://community.splunk.com/t5/Knowledge-Management/Is-there-an-error-in-the-quot-Creating-Splunk-Knowledge-Objects/m-p/233108#M7929 <P>i've let folks in the edu group know about this, they should post here when they confirm etc. </P> Fri, 06 May 2016 17:53:15 GMT https://community.splunk.com/t5/Knowledge-Management/Is-there-an-error-in-the-quot-Creating-Splunk-Knowledge-Objects/m-p/233108#M7929 piebob 2016-05-06T17:53:15Z https://community.splunk.com/t5/Knowledge-Management/Is-there-an-error-in-the-quot-Creating-Splunk-Knowledge-Objects/m-p/233109#M7930 <P>You are correct.</P> <P>The statement should be :<BR /> "Lookup data can not be used in a calculated field, because lookup data does not exist at the time of calculation."<BR /> Not that calculated fields can not be used with lookups.</P> <P>This bug will be fixed on next release of the course.</P> <P>Here are the details from the Docs:</P> <P>You cannot base calculated fields on lookup fields. It won't work if you try. This is because, as mentioned above, the evaluation of calculated fields takes place after search-time field extraction and field aliasing, but before derivation of lookup fields.</P> Fri, 06 May 2016 18:52:50 GMT https://community.splunk.com/t5/Knowledge-Management/Is-there-an-error-in-the-quot-Creating-Splunk-Knowledge-Objects/m-p/233109#M7930 cbreshears_splu 2016-05-06T18:52:50Z https://community.splunk.com/t5/Knowledge-Management/Is-there-an-error-in-the-quot-Creating-Splunk-Knowledge-Objects/m-p/233110#M7931 <P>I converted this to the answer,</P> Fri, 06 May 2016 19:22:35 GMT https://community.splunk.com/t5/Knowledge-Management/Is-there-an-error-in-the-quot-Creating-Splunk-Knowledge-Objects/m-p/233110#M7931 jkat54 2016-05-06T19:22:35Z