Issues with props.conf and EVAL function

shayhibah — Tue, 07 Jan 2020 08:54:16 GMT

Hi,

I am trying to add new evaluation for a field in search-time.
For some reason, when I run query from my search head, I get the old values and it seems that the props.conf is not working.

Here is my configuration:

EVAL-action = if(isnull(action), action, if(eventtype == "Intrusion_Detection", if(action IN ("Accept", "Detect", "Allow"),"allowed", "blocked"),action))

If i copy the above line to the search bar, it works OK.

Must mention that I modified props.conf under default directory.

What am I missing here?

Update - I found out that I have 2 EVAL for the same field - does it look only for the last one or do everything in order?

Re: Issues with props.conf and EVAL function

gfreitas — Tue, 07 Jan 2020 11:47:02 GMT

If one interferes with the other yes you might have problems. See this link for file precedences: https://docs.splunk.com/Documentation/Splunk/8.0.1/Admin/Wheretofindtheconfigurationfiles

You might also need to wait the knowledge bundle to be deployed to the indexers before you can see the configuration working (which might take a few minutes)

topic Re: Issues with props.conf and EVAL function in Splunk Search

Issues with props.conf and EVAL function

Re: Issues with props.conf and EVAL function