topic Re: CASE command in Props.conf in Splunk Search

CASE command in Props.conf

pavanbmishra — Thu, 25 Mar 2021 13:31:24 GMT

Hello SMEs....Seeking helping hand

I got stuck while putting EVAL-<field-name> in props.conf using case command and it is not at all working while the same is working in search bar in GUI. As suggestion would be highly appreciated

EVAL-XYZ = case(src== "AAA", field1, src== "BBB", field2 , src== "CCC", field3)

Re: CASE command in Props.conf

Vardhan — Thu, 25 Mar 2021 13:41:23 GMT

HI @pavanbmishra,

The eval -xyz filed name have you used anywhere else in the same props. conf? And where exactly have you placed the props. conf?

Re: CASE command in Props.conf

pavanbmishra — Thu, 25 Mar 2021 13:55:07 GMT

Thanks Vardhan for your quick help 🙂

No i am not using that eval-xyz field anywhere in the props.conf, i put my config file under below folder

/etc/apps/<app-name>/local folder

Re: CASE command in Props.conf

Vardhan — Thu, 25 Mar 2021 14:05:47 GMT

Hi @pavanbmishra,

Did you verify the local.meta of your apps folder? And also the after placing the props.conf in search head can you quickly restart and check if it is a single instance. For distributed search head cluster no restart required.

The only eval is not working all other fields are working fine?

Re: CASE command in Props.conf

pavanbmishra — Thu, 25 Mar 2021 14:15:42 GMT

Yeah all filed working except that eval expression. What should i check under local.meta ?

BTW it is single instance and i restarted that also. Thanks 🙂

Re: CASE command in Props.conf

Vardhan — Thu, 25 Mar 2021 14:23:22 GMT

Hi @pavanbmishra ,

Can you try with the below eval and see the result.

EVAL-XYZ = case(src== "AAA", "field1", src== "BBB", "field2" , src== "CCC", "field3")

And also make sure you are able to see the mentioned src fields values in the case.

Re: CASE command in Props.conf

s2_splunk — Thu, 25 Mar 2021 19:17:39 GMT

I would suggest to add a default option at the end to see whether this eval just doesn't match any of your options (or your sourcetype?) and go from there. Generally, it looks correct. Case-sensitivity for field names is my only idea. Try this and see if you at least get your field with the default value:

EVAL-XYZ = case(src="AAA", field1, src="BBB", field2 , src="CCC", field3, 1=1, "HITTING DEFAULT IN EVAL")

If this doesn't help and you can, please post your exact props.conf file