Here's a quick question I am trying to implement calculated fields in props.conf using EVAL command following is the code that I am trying to implement:
EVAL-PAYXLINE_MV2=mvindex(PAYXLINE_MV,N,-1)
EVAL-PAYXLINEGLOB=mvjoin(PAYXLINE_MV2," ")
EVAL-PAYXHASH=sha256(mvjoin(PAYXLINE_MV," "))
The problem is I am not able to get the first 2 commands working when I put mvindex and mvjoin directly but it works perfectly fine when I use mvjoin with sha256. Can you help me to solve this problem. Here is the documentation that I am following to define fields in props.conf.
http://docs.splunk.com/Documentation/Splunk/6.2.1/Knowledge/definecalcfields
Can you share your props.conf
and transforms.conf
lines for the PAYXLINE_MV field?
Well, in your first two statements you're evaluating PAYXLINE_MV2 on the first and then calling it again on the second. Calculated fields are evaluated in parallel and not in sequence; i.e. PAYXLINE_MV2 is not availalbe to the 2nd statement when it tries to execute. Try something like this:
EVAL-PAYXLINEGLOB=mvjoin(mvindex(PAYXLINE_MV,N,-1)," ")
This comment about it happening in parallel vs in order fixed an issue I had for days!
Not working I tried doing that previously.
That should work if 'PAYXLINE_MV' is indeed a multivalued field and 'N' is a number.
yea its a multivalued field and N is number
In addition to being a number, N needs to be within the range of the length of the multivalued field.
mvjoin works perfectly in props.conf right ?