Getting Data In

Lookup fields: How to re-evaluate or re-alias in props?

koshyk
Super Champion

As per props.conf spec

Splunk processes lookups after it processes field extractions, field   aliases, and calculated fields (EVAL-* statements). This means that you   can use extracted fields, aliased fields, and calculated fields to specify   lookups. But you can't use fields discovered by lookups in the configurations of extracted fields, aliased fields, or calculated fields.

Currently our TA have got LOOKUP in props.conf . But there are so much enriched information after the LOOKUP which is further required for EVAL/FIELDALIAS to create a model. How to make use of these "calculated" fields again in props.conf?

Is there any trick/tips to override the above restriction? i.e. use the discovered fields from lookup to be Aliased to a CIM field in props.conf?

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi koshyk,
if you don't want to redefine every time calculated fields from lookup fields, you could create one or more macros to do this and recoll them when you need calculated fields.
I used this method.
Bye.
Giuseppe

0 Karma

koshyk
Super Champion

thanks mate. but how can you do that in props.conf?

0 Karma

gcusello
SplunkTrust
SplunkTrust
0 Karma

somesoni2
Revered Legend

What is your exact requirement? Do you want to rename a field coming from lookup to something already existing?

0 Karma

koshyk
Super Champion

The exact requirement is:
Currently our TA have got LOOKUP in props.conf . But there are so much enriched information after the LOOKUP which is further required for EVAL/FIELDALIAS to create a model. How to make use of these "calculated" fields again in props.conf?

(I've updated the requirement to the question as well)

0 Karma
Get Updates on the Splunk Community!

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...

Updated Team Landing Page in Splunk Observability

We’re making some changes to the team landing page in Splunk Observability, based on your feedback. The ...

New! Splunk Observability Search Enhancements for Splunk APM Services/Traces and ...

Regardless of where you are in Splunk Observability, you can search for relevant APM targets including service ...