I wanted to add a field to a specific sourcetype
nocmessage="ignore this server"
Seemed easy enough
EVAL-nocmessage="ignore this server"
But doesn't seem to work. If I toss that same message into a if statement it how ever does work. Is there a trick to this?
Turns out I was being too impatient waiting for the search head cluster to sync.
What are the permissions on the calculated field that you created? Is it visible in only one app, or is it global, etc?
Where do you add this to props.conf ? I hope it's search head and you restarted your splunk instance after the change.