Is there a way to set all fields using eval in Props.conf

[noott211]

Props.conf

[mysourcetype]

EVAL-field1=trim(field1)

Field1 must contain all fields for that source type.

Is there a way?

[gcusello]

Hi @noott211,

the easiest approach is to do all the field extractions or calculation by GUI in the destination app, so you don't need to modify conf files (and restart Splunk).

If you want to use conf files, you can write your evals in props, but it less easy.

Why do you want to do this?

Ciao.

Giuseppe