In my props.conf file I have a lot of EVAL functions.
Some of them have the same name. For example:
EVAL-src_name = if(isnull(src),s_name,src)
EVAL-src_name = if(isnull(src_ip),s_name,src_ip)
EVAL-dst_name = if(isnull(dst),d_name,dst)
EVAL-dst_name = if(isnull(dst_ip),d_name,dst_ip)
There is no option that the same log will be appropriate for 2 stanzas with the same name.
Since I have duplicates in EVAL names, I get a failure from AppInspect.
How can I deal with it while keeping the logic?
How is the case statement?
EVAL-src_name=case(isnotnull(src), src, isnotnull(src_ip), src_ip,1==1,s_name)