Getting Data In

What is the execution order for EXTRACT, REPORT, EVAL, LOOKUP and ALIAS in props.conf?

olivier_jpmc
Engager

Hello all,

Anyone would have an idea of the execution order of EXTRACT, REPORT, EVAL, LOOKUP and ALIAS in the props.conf?

I understand that REPORT-policy_date will be executed before REPORT-policy_name because of the ASCII order of the class, but how about:

  • EXTRACT-aa
  • REPORT-bb
  • EVAL-aa
  • LOOKUP-bb
  • ALIAS-aa

I have an ALIAS for instance that depends on a field extracted in a REPORT but it doesn't seem to work.

Regards,
Olivier

Tags (1)
1 Solution

woodcock
Esteemed Legend

From this:
http://docs.splunk.com/Documentation/Splunk/6.2.3/Knowledge/Addaliasestofields

We see this:
Important: Field aliasing is performed after key/value extraction but before field lookups. Therefore, you can specify a lookup table based on a field alias. This can be helpful if there are one or more fields in the lookup table that are identical to fields in your data, but have been named differently. For more information read "Configure CSV and external lookups" and "Configure KV store lookups" in this manual.

This implies that it happens before search-time extractions (REPORT-) so you would be best off changing your REPORT- to EXTRACT or you could perform a second REPORT- like this:

[MyFieldAlias]
SOURCE_KEY=MyField
REGEX=^(?<MyFieldAlias>.*)$

View solution in original post

Lowell
Super Champion

Thanks to Matt Ness on the docs team for pointing out this link. This is pure gold!

http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Searchtimeoperationssequence

woodcock
Esteemed Legend

From this:
http://docs.splunk.com/Documentation/Splunk/6.2.3/Knowledge/Addaliasestofields

We see this:
Important: Field aliasing is performed after key/value extraction but before field lookups. Therefore, you can specify a lookup table based on a field alias. This can be helpful if there are one or more fields in the lookup table that are identical to fields in your data, but have been named differently. For more information read "Configure CSV and external lookups" and "Configure KV store lookups" in this manual.

This implies that it happens before search-time extractions (REPORT-) so you would be best off changing your REPORT- to EXTRACT or you could perform a second REPORT- like this:

[MyFieldAlias]
SOURCE_KEY=MyField
REGEX=^(?<MyFieldAlias>.*)$

olivier_jpmc
Engager

Hello, thank you very much for your help. And nice finding.

I received this order of execution as well from a Splunk person, that confirms what you said:
• REPORT/EXTRACT
• FIELDALIAS
• EVAL
• LOOKUP

Thank you very much again.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...