I am trying to use a filed in calculated fields from props.conf to replace space in one of my field values but not getting any results in Splunk 6.2.
Below is EVAL stanza from props.conf -
Not getting any new field "Customer_Id_New" in interesting field for that sourcetype. Please help me if you can.
Thanks in advance
Make sure the
Customer_Id field is actually present at the time calculated fields are executed, and that it's not a calculated field itself.
If you added a knowledge object through the UI it is by default stored in your user context, etc/users/name/appname/local/props.conf - to move it to the app context etc/apps/appname/local/props.conf you need to share the knowledge object within the app.
Hi, I have similar problem when entered from backed in props.conf. However calculated field works when wrote eval from GUI front end.
But after restart of the splunk instances also, i do not see any entry added in that sourcetype stanza.
New field always appears.
Question is where does splunk keeps entry of calculated fields?