- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Is there a way to set all fields using eval in Props.conf
noott211
Path Finder
02-18-2022
12:28 AM
Props.conf
[mysourcetype]
EVAL-field1=trim(field1)
Field1 must contain all fields for that source type.
Is there a way?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

gcusello

SplunkTrust
02-18-2022
12:57 AM
Hi @noott211,
the easiest approach is to do all the field extractions or calculation by GUI in the destination app, so you don't need to modify conf files (and restart Splunk).
If you want to use conf files, you can write your evals in props, but it less easy.
Why do you want to do this?
Ciao.
Giuseppe
