topic Calculated field always evaluates to zero in Splunk Enterprise Security

Calculated field always evaluates to zero

davidmonaghan — Fri, 19 Jan 2018 12:04:29 GMT

Hi All

I am attempting to create a field called app for Enterprise Security based off of Cisco WSA Squid logs

To create the field, I use a field alias of the sourcetype to fill the value of app

Next I am trying to use a calculated field to determine to final value app=case(app="cisco:wsa:squid","squid")

Testing this in a basic search works fine sourcetype=cisco:wsa:squid | eval app=case(app="cisco:wsa:squid","squid") | table _time, app

But using that search as a calculated field always evaluates to zero.

Anyone have any idea why?

Re: Calculated field always evaluates to zero

mayurr98 — Fri, 19 Jan 2018 12:22:47 GMT

I have two queries.
1) what eval expression you have configured . can you give the artifacts of local/props.conf where this calculated field configuration is.
2) Try making calculated field permissions to global.

Re: Calculated field always evaluates to zero

davidmonaghan — Fri, 19 Jan 2018 13:00:07 GMT

1) I used the Splunk Web interface. The eval expression used was app=case(app="cisco:wsa:squid","squid")
2) Permission have been set to global

Re: Calculated field always evaluates to zero

mayurr98 — Fri, 19 Jan 2018 13:04:13 GMT

You need to write only case(app="cisco:wsa:squid","squid") in the eval expression. Field name you have to specify in Name.

Re: Calculated field always evaluates to zero

davidmonaghan — Mon, 22 Jan 2018 10:53:21 GMT

Thanks that worked perfectly

Re: Calculated field always evaluates to zero

mayurr98 — Mon, 22 Jan 2018 11:43:33 GMT

I have converted my comment to an answer. If you deem a posted answer as valid and helpful to your solving of the issue, please accept said answer so that this question no longer appears open.