All Apps and Add-ons

When is "site" generated?

sov_gwright
New Member

I'm trying to use eval to calculate another field, using something simple

newfield = eval if(like(http_request,"%"+site+"%"),1,0)

This works fine from the search command line, but does not evaluate when I do it as an automatic field calculation, it's like the "site" field has not yet been defined and I cannot find where that is configured. Any ideas?

0 Karma
1 Solution

jbjerke_splunk
Splunk Employee
Splunk Employee

Hi

Please check out the documentation page for the app. There's some steps you need to do to configure it. The site fields comes from a lookup.

j

View solution in original post

0 Karma

jbjerke_splunk
Splunk Employee
Splunk Employee

Hi

Please check out the documentation page for the app. There's some steps you need to do to configure it. The site fields comes from a lookup.

j

0 Karma

wryanthomas
Communicator

Have you looked to see if 'site' field occurs earlier in the search-time order of operations? (https://docs.splunk.com/Documentation/Splunk/8.0.2/Knowledge/definecalcfields)

http://docs.splunk.com/Documentation/Splunk/8.0.2/Knowledge/Searchtimeoperationssequence

Also -- I've sometimes had to rename fields (e.g., add a z prefix) to make sure a field I need to reference is calculated prior to this calculated field.

0 Karma

sov_gwright
New Member

That's part of the problem, I cannot even find where the "site" field is defined - it's not in extractions, calculated or aliases.

0 Karma

wryanthomas
Communicator

Check out props.conf (search for 'site'.)

From transforms.conf in the app...
[WA_sessions]
external_type = kvstore
fields_list = _time,site,user,http_session,http_session_start,http_session_end,http_session_pageviews,http_session_duration,http_session_referrer,http_session_referrer_domain,http_session_referrer_hostname,http_session_channel
time_field = _time
filename =

[WA_pages]
external_type = kvstore
fields_list = site,http_request
filename =

0 Karma
Get Updates on the Splunk Community!

Dashboard Studio Challenge - Learn New Tricks, Showcase Your Skills, and Win Prizes!

Reimagine what you can do with your dashboards. Dashboard Studio is Splunk’s newest dashboard builder to ...

Introducing Edge Processor: Next Gen Data Transformation

We get it - not only can it take a lot of time, money and resources to get data into Splunk, but it also takes ...

Take the 2021 Splunk Career Survey for $50 in Amazon Cash

Help us learn about how Splunk has impacted your career by taking the 2021 Splunk Career Survey. Last year’s ...