When is "site" generated?

[sov_gwright]

I'm trying to use eval to calculate another field, using something simple

newfield = eval if(like(http_request,"%"+site+"%"),1,0)

This works fine from the search command line, but does not evaluate when I do it as an automatic field calculation, it's like the "site" field has not yet been defined and I cannot find where that is configured. Any ideas?

[jbjerke_splunk · Accepted solution]

Hi

Please check out the documentation page for the app. There's some steps you need to do to configure it. The site fields comes from a lookup.

j

[wryanthomas]

Have you looked to see if 'site' field occurs earlier in the search-time order of operations? (https://docs.splunk.com/Documentation/Splunk/8.0.2/Knowledge/definecalcfields)

http://docs.splunk.com/Documentation/Splunk/8.0.2/Knowledge/Searchtimeoperationssequence

Also -- I've sometimes had to rename fields (e.g., add a z prefix) to make sure a field I need to reference is calculated prior to this calculated field.

[sov_gwright]

That's part of the problem, I cannot even find where the "site" field is defined - it's not in extractions, calculated or aliases.

[wryanthomas]

Check out props.conf (search for 'site'.)

From transforms.conf in the app...
[WA_sessions]
external_type = kvstore
fields_list = _time,site,user,http_session,http_session_start,http_session_end,http_session_pageviews,http_session_duration,http_session_referrer,http_session_referrer_domain,http_session_referrer_hostname,http_session_channel
time_field = _time
filename =

[WA_pages]
external_type = kvstore
fields_list = site,http_request
filename =