Why after adding the Splunk Web Analytics are all 'user' fields hexadecimal strings?

[jneuhaus]

Before adding Splunk Web Analytics 'user' fields were exactly what's in the log files. After add Splunk Web Analytics 'user' fields are hexadecimal or HASH values that break lookup tables, etc.

[jbjerke_splunk]

Hi jneuhaus

Sorry for taking so long to reply to this. I blame it on the holiday season.

The default scope of the "user" calculated field was set to "Global". This means it will affect all apps. I will change this in the next release as it is not needed. In the meantime you can change this yourself by going into
Settings->Fields->Calculated Fields

Click on the "Permissions" link on the line that says "user" . Change the scope to "This app only".

This change will keep the user field intact on all other apps so the problem you are seeing should be fixed.

j

[jneuhaus]

Thanks for the response, but there does seem to be some confusion regarding the 'user' field being overwritten: It seems to have affected the standard Search and Reporting App as well, not just the Web Analytics App. In other words, after installing Web Analytics and generating the unique IDs, those ID's now show up in previously defined Searches and Reports breaking lookups, etc. If I understand your workaround above I'll be defining the orig_user for Web Analytics instead, and the 'user' field will be left alone, is that correct?

Again, thanks for the responding and keep up the great work!

[jbjerke_splunk]

Hi jneuhaus

The app generates a field called user with a unique user "id" - a hexadecimal string. This is then used by the sessionization process. I understand it's not ideal if you already have a user field that gets overwritten in this way. However, this only happens within the context of the app so it should not affect any other dashboards or apps already using that field.

A workaround is to copy the existing field into a new field (orig_user) using the eval command.

Add this to a props.conf in the local folder of the app

SPLUNK_HOME/etc/apps/SplunkAppForWebAnalytics/local

[MYSOURCETYPE]
EVAL-orig_user = user

Alternatively you can do this from the Settings menu:
Settings->Fields->Calculated Fields->Add New

I will add a fix for this problem in the next release of the app.

j