Getting Data In

Overwrite App-default EVAL in props.conf with FieldAlias

Mockjin
Explorer

Hello *

how can i overwrite the default eval definition for field app in props.conf?

default/props.conf

 

...
EVAL-app = "Blue Coat ProxySG"
...

 

I try to overwrite this field with following in local/props.conf

 

...
FIELDALIAS-app             = x_bluecoat_application_name as app
...

 

We use a distributed Environment so i changed this in SH and HF app. But no change to the results.

What am i doing wrong?

Labels (3)
0 Karma
1 Solution

venkatasri
SplunkTrust
SplunkTrust

Hi @Mockjin 

As per precedence EVAL executes after FIELDALIAS hence though you created a alias as 'app' same is being overridden with EVAL-* expression in default/ dir.

Can you try this in local/props.conf and deploy the changes to SH and restart.

EVAL-app = x_bluecoat_application_name

----

An upvote would be appreciated and Accept solution if this reply helps !

 

View solution in original post

0 Karma

venkatasri
SplunkTrust
SplunkTrust

Hi @Mockjin 

As per precedence EVAL executes after FIELDALIAS hence though you created a alias as 'app' same is being overridden with EVAL-* expression in default/ dir.

Can you try this in local/props.conf and deploy the changes to SH and restart.

EVAL-app = x_bluecoat_application_name

----

An upvote would be appreciated and Accept solution if this reply helps !

 

0 Karma

Mockjin
Explorer

Hi @venkatasri ,

 

your solution worked for me.  Thanks 🙂

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...