Getting Data In

Overwrite App-default EVAL in props.conf with FieldAlias

Mockjin
Explorer

Hello *

how can i overwrite the default eval definition for field app in props.conf?

default/props.conf

 

...
EVAL-app = "Blue Coat ProxySG"
...

 

I try to overwrite this field with following in local/props.conf

 

...
FIELDALIAS-app             = x_bluecoat_application_name as app
...

 

We use a distributed Environment so i changed this in SH and HF app. But no change to the results.

What am i doing wrong?

Labels (3)
0 Karma
1 Solution

venkatasri
SplunkTrust
SplunkTrust

Hi @Mockjin 

As per precedence EVAL executes after FIELDALIAS hence though you created a alias as 'app' same is being overridden with EVAL-* expression in default/ dir.

Can you try this in local/props.conf and deploy the changes to SH and restart.

EVAL-app = x_bluecoat_application_name

----

An upvote would be appreciated and Accept solution if this reply helps !

 

View solution in original post

0 Karma

venkatasri
SplunkTrust
SplunkTrust

Hi @Mockjin 

As per precedence EVAL executes after FIELDALIAS hence though you created a alias as 'app' same is being overridden with EVAL-* expression in default/ dir.

Can you try this in local/props.conf and deploy the changes to SH and restart.

EVAL-app = x_bluecoat_application_name

----

An upvote would be appreciated and Accept solution if this reply helps !

 

0 Karma

Mockjin
Explorer

Hi @venkatasri ,

 

your solution worked for me.  Thanks 🙂

0 Karma
Get Updates on the Splunk Community!

Index This | I’m short for "configuration file.” What am I?

May 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with a Special ...

New Articles from Academic Learning Partners, Help Expand Lantern’s Use Case Library, ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Your Guide to SPL2 at .conf24!

So, you’re headed to .conf24? You’re in for a good time. Las Vegas weather is just *chef’s kiss* beautiful in ...