Calculated field configuration (EVAL) not working in props.conf

[513239]

I am trying to use a filed in calculated fields from props.conf to replace space in one of my field values but not getting any results in Splunk 6.2.

Below is EVAL stanza from props.conf -

EVAL-Customer_Id_New=replace(Customer_Id," ","")

Not getting any new field "Customer_Id_New" in interesting field for that sourcetype. Please help me if you can.

Thanks in advance

[martin_mueller]

Make sure the Customer_Id field is actually present at the time calculated fields are executed, and that it's not a calculated field itself.

Sequence reference: http://docs.splunk.com/Documentation/Splunk/6.5.2/Knowledge/Searchtimeoperationssequence#Search-time...

[martin_mueller]

More common errors to check:

• Are you in the right app/user context?
• Is the calculated field defined for the right sourcetype, source, or host?

[arunsunny]

@martin_mueller - I have a question on declaring calculated field names with spaces?

For Example:
EVAL-Cricket Team Name=team_name

Will this work?

[martin_mueller]

Sounds like a new question, so please create one. While you do that, also test if your calcfield works.

[513239]

Yes. Customer_Id field is present at the time calculated fields are executed, and it's not a calculated field.

[martin_mueller]

If you added a knowledge object through the UI it is by default stored in your user context, etc/users/name/appname/local/props.conf - to move it to the app context etc/apps/appname/local/props.conf you need to share the knowledge object within the app.

[anantdeshpande]

Hi, I have similar problem when entered from backed in props.conf. However calculated field works when wrote eval from GUI front end.

But after restart of the splunk instances also, i do not see any entry added in that sourcetype stanza.
New field always appears.

Question is where does splunk keeps entry of calculated fields?