https://community.splunk.com/t5/Splunk-Search/How-to-use-calculated-field-with-url/m-p/409504#M118147 <P>Unfortunately for me (because is kind of shame) I found the issue and it was with the browser sessions. By luck closing and re-opening the browser all my changes were working which is not ideal</P> Wed, 12 Jun 2019 13:34:18 GMT a_naoum 2019-06-12T13:34:18Z https://community.splunk.com/t5/Splunk-Search/How-to-use-calculated-field-with-url/m-p/409495#M118138 <P>Hello,</P> <P>I'm trying to use calculated field on data with url field. Simple doesn't work. Even a very simple 'upper(url)' doesn't work.<BR /> If I'm doing |eval upper(url) it works perfect. <BR /> Is there any known restriction which I didn't see somewhere in the documentation?</P> <P>Please note that the search is done on 7.0.3 fresh installation (literally nothing installed)</P> Thu, 06 Jun 2019 13:56:40 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-calculated-field-with-url/m-p/409495#M118138 a_naoum 2019-06-06T13:56:40Z https://community.splunk.com/t5/Splunk-Search/How-to-use-calculated-field-with-url/m-p/409496#M118139 <P>@a_naoum - Please clarify first part your question, where you are saying upper(url) is not working?</P> Thu, 06 Jun 2019 14:22:11 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-calculated-field-with-url/m-p/409496#M118139 VatsalJagani 2019-06-06T14:22:11Z https://community.splunk.com/t5/Splunk-Search/How-to-use-calculated-field-with-url/m-p/409497#M118140 <P>Is the url an extracted field?? Do you see it in field sidebar?</P> Thu, 06 Jun 2019 20:16:05 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-calculated-field-with-url/m-p/409497#M118140 somesoni2 2019-06-06T20:16:05Z https://community.splunk.com/t5/Splunk-Search/How-to-use-calculated-field-with-url/m-p/409498#M118141 <P>yes, it is. The specific events are simple KV with '=' separated fields</P> Fri, 07 Jun 2019 06:26:05 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-calculated-field-with-url/m-p/409498#M118141 a_naoum 2019-06-07T06:26:05Z https://community.splunk.com/t5/Splunk-Search/How-to-use-calculated-field-with-url/m-p/409499#M118142 <P>correct. I done the same via GUI and props.conf. If I do the same 'upper' on a different field, it works. It is hard to miss the field name (it is just... url)</P> Fri, 07 Jun 2019 06:27:04 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-calculated-field-with-url/m-p/409499#M118142 a_naoum 2019-06-07T06:27:04Z https://community.splunk.com/t5/Splunk-Search/How-to-use-calculated-field-with-url/m-p/409500#M118143 <P>Is it not working in props.conf or in search or in datamodel?</P> Sat, 08 Jun 2019 05:46:50 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-calculated-field-with-url/m-p/409500#M118143 VatsalJagani 2019-06-08T05:46:50Z https://community.splunk.com/t5/Splunk-Search/How-to-use-calculated-field-with-url/m-p/409501#M118144 <P>I said not. Datamodel is not used but I don't need to for now.</P> Mon, 10 Jun 2019 06:25:50 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-calculated-field-with-url/m-p/409501#M118144 a_naoum 2019-06-10T06:25:50Z https://community.splunk.com/t5/Splunk-Search/How-to-use-calculated-field-with-url/m-p/409502#M118145 <P>Hi @a_naoum,</P> <P>This is due to the permissions of your app and your calculated field and whether the configuration is set to <CODE>private</CODE>, <CODE>app</CODE> or <CODE>global</CODE>. </P> <P>If you created your calculated field in app <CODE>A</CODE> and this app doesn't export its configuration then you won't be able to see that calculated field in app <CODE>B</CODE> or <CODE>search</CODE> app. Same if you created it with user X and the permissions are set to private, then user Y won't be able to see it.</P> <P>Please check the configurations and make sure you're in the right app when testing your field.</P> <P>Refer here for basic permission configs : <BR /> <A href="https://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Manageknowledgeobjectpermissions">https://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Manageknowledgeobjectpermissions</A></P> <P>Cheers,<BR /> David</P> Mon, 10 Jun 2019 09:01:00 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-calculated-field-with-url/m-p/409502#M118145 DavidHourani 2019-06-10T09:01:00Z https://community.splunk.com/t5/Splunk-Search/How-to-use-calculated-field-with-url/m-p/409503#M118146 <P>Can you tell where url field is coming from? If url it self is evaluated somewhere else in props.conf this will not work as all eval executes in parallel.</P> Mon, 10 Jun 2019 09:02:19 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-calculated-field-with-url/m-p/409503#M118146 VatsalJagani 2019-06-10T09:02:19Z https://community.splunk.com/t5/Splunk-Search/How-to-use-calculated-field-with-url/m-p/409504#M118147 <P>Unfortunately for me (because is kind of shame) I found the issue and it was with the browser sessions. By luck closing and re-opening the browser all my changes were working which is not ideal</P> Wed, 12 Jun 2019 13:34:18 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-calculated-field-with-url/m-p/409504#M118147 a_naoum 2019-06-12T13:34:18Z https://community.splunk.com/t5/Splunk-Search/How-to-use-calculated-field-with-url/m-p/409505#M118148 <P>I done the changes on props.conf of the app as I mention to someone, so in that case there is no permissions issue.<BR /> Anyway, case solved. Browser</P> Wed, 12 Jun 2019 13:42:56 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-calculated-field-with-url/m-p/409505#M118148 a_naoum 2019-06-12T13:42:56Z