topic Re: EVAL is overwriting field of other add-on in Splunk Search

EVAL is overwriting field of other add-on

rleena — Wed, 01 Feb 2017 02:04:29 GMT

Hi,

I have an EVAL statements in two add-ons. The field names are same and the add-on that comes later in alphabetical order, overwrites the value set by earlier add-on. I have tried coalesce with if statement, but not able to solve this problem. In the second add-on when I am checking, looks like the value of the field is null and the one that has been set by the earlier add-on. So seems like there is no way to retain it conditionally, rather than overwriting it.

Kindly suggest a solution. Thank you.

Re: EVAL is overwriting field of other add-on

lguinn2 — Wed, 01 Feb 2017 21:47:18 GMT

My suggestion would be to not use the same field name in two different add-ons.

Re: EVAL is overwriting field of other add-on

somesoni2 — Wed, 01 Feb 2017 22:34:16 GMT

These are add-ons you downloaded from Splunk apps or your custom? A suggested by Lisa, either don't use the same named field in two add-ons or remove the EVAL from both the Add-ons and create it in separate add-on/apps.

Re: EVAL is overwriting field of other add-on

rleena — Thu, 02 Feb 2017 05:03:08 GMT

Hello, Thank you for response. I am trying to create a custom add-on.

Re: EVAL is overwriting field of other add-on

somesoni2 — Thu, 02 Feb 2017 05:07:16 GMT

So, in the EVAL of the custom add-on which has higher precedence, you include the condition/expression you used in first add-on as well. So that if it's overwrite, it still follows the same expression.

E.g. add-on 1

EVAL-field = <<some expression giving value1>>

add-on 2

EVAL-field = coalesce(<<some expression giving value2>>,<<some expression giving value1>>)

Re: EVAL is overwriting field of other add-on

rleena — Thu, 02 Feb 2017 05:14:55 GMT

Thank you. I want to check expression for my messages and set a value for field using EVAL if expression is true, and if not, then don't touch the existing field value for other messages. Is that possible?

Re: EVAL is overwriting field of other add-on

somesoni2 — Thu, 02 Feb 2017 05:27:44 GMT

Did you try like this already

2nd Add-on

EVAL-field = if(<<some_expression evaluate true>>,"SomesValue",field)

If above doesn't work, can you share the EVAL definition that you have in other add-on?

Re: EVAL is overwriting field of other add-on

rleena — Thu, 02 Feb 2017 05:32:55 GMT

yes I have tried, the field value is null in my add-on. I even checked with isnull(). So when condition is not evaluating to true, it overwrites with null for other messages

Re: EVAL is overwriting field of other add-on

somesoni2 — Thu, 02 Feb 2017 05:44:42 GMT

Can you share the exact props.conf entry that you have/tried in both the add-on for that field?

Re: EVAL is overwriting field of other add-on

rleena — Tue, 29 Sep 2020 12:42:22 GMT

In the first add-on which is not mine,
EVAL-vendor_product = "abc"

In my add-on: (comes alphabetically next)
EVAL-vendor_product = if(searchmatch("testproduct"),"test",vendor_product)

Now, "test" is correctly assigned to my messages, but for other messages "abc" is overwritten by null. vendor_product field is removed basically.

Re: EVAL is overwriting field of other add-on

somesoni2 — Wed, 30 Sep 2020 01:20:44 GMT

You need to copy the expression used in first add-on to your add-on where you're setting the default value. So you need to use this in your add-on.

EVAL-vendor_product = if(searchmatch("testproduct"),"test","abc")

If your add-on is installed, the first add-on's configuration doesn't apply and there is no verndor_product field available before hand. So when your's is evaluated, it assigns null for vendor_product to events which are not matching your expression.

Re: EVAL is overwriting field of other add-on

rleena — Thu, 02 Feb 2017 07:11:01 GMT

Thank you. That's what I wanted to confirm.