Lookup fields: How to re-evaluate or re-alias in props?

[koshyk]

As per props.conf spec

Splunk processes lookups after it processes field extractions, field   aliases, and calculated fields (EVAL-* statements). This means that you   can use extracted fields, aliased fields, and calculated fields to specify   lookups. But you can't use fields discovered by lookups in the configurations of extracted fields, aliased fields, or calculated fields.

Currently our TA have got LOOKUP in props.conf . But there are so much enriched information after the LOOKUP which is further required for EVAL/FIELDALIAS to create a model. How to make use of these "calculated" fields again in props.conf?

Is there any trick/tips to override the above restriction? i.e. use the discovered fields from lookup to be Aliased to a CIM field in props.conf?

[gcusello]

Hi koshyk,
if you don't want to redefine every time calculated fields from lookup fields, you could create one or more macros to do this and recoll them when you need calculated fields.
I used this method.
Bye.
Giuseppe

[koshyk]

thanks mate. but how can you do that in props.conf?

[gcusello]

Hi koshyk,
you can create a macro fron web interface.
see http://docs.splunk.com/Documentation/Splunk/6.6.2/Knowledge/Usesearchmacros or http://docs.splunk.com/Documentation/Splunk/6.6.2/Admin/macrosconf

Bye.
Giuseppe

[somesoni2]

What is your exact requirement? Do you want to rename a field coming from lookup to something already existing?

[koshyk]

The exact requirement is:
Currently our TA have got LOOKUP in props.conf . But there are so much enriched information after the LOOKUP which is further required for EVAL/FIELDALIAS to create a model. How to make use of these "calculated" fields again in props.conf?

(I've updated the requirement to the question as well)