Getting Data In

Lookup fields: How to re-evaluate or re-alias in props?

Super Champion

As per props.conf spec

Splunk processes lookups after it processes field extractions, field   aliases, and calculated fields (EVAL-* statements). This means that you   can use extracted fields, aliased fields, and calculated fields to specify   lookups. But you can't use fields discovered by lookups in the configurations of extracted fields, aliased fields, or calculated fields.

Currently our TA have got LOOKUP in props.conf . But there are so much enriched information after the LOOKUP which is further required for EVAL/FIELDALIAS to create a model. How to make use of these "calculated" fields again in props.conf?

Is there any trick/tips to override the above restriction? i.e. use the discovered fields from lookup to be Aliased to a CIM field in props.conf?

0 Karma

Legend

Hi koshyk,
if you don't want to redefine every time calculated fields from lookup fields, you could create one or more macros to do this and recoll them when you need calculated fields.
I used this method.
Bye.
Giuseppe

0 Karma

Super Champion

thanks mate. but how can you do that in props.conf?

0 Karma

Legend
0 Karma

SplunkTrust
SplunkTrust

What is your exact requirement? Do you want to rename a field coming from lookup to something already existing?

0 Karma

Super Champion

The exact requirement is:
Currently our TA have got LOOKUP in props.conf . But there are so much enriched information after the LOOKUP which is further required for EVAL/FIELDALIAS to create a model. How to make use of these "calculated" fields again in props.conf?

(I've updated the requirement to the question as well)

0 Karma