Getting Data In

Why are mvindex and mvjoin not working while using eval to define calculated fields in props.conf?

tsawant
New Member

Here's a quick question I am trying to implement calculated fields in props.conf using EVAL command following is the code that I am trying to implement:

EVAL-PAYXLINE_MV2=mvindex(PAYXLINE_MV,N,-1) 
EVAL-PAYXLINEGLOB=mvjoin(PAYXLINE_MV2," ")
EVAL-PAYXHASH=sha256(mvjoin(PAYXLINE_MV," "))

The problem is I am not able to get the first 2 commands working when I put mvindex and mvjoin directly but it works perfectly fine when I use mvjoin with sha256. Can you help me to solve this problem. Here is the documentation that I am following to define fields in props.conf.
http://docs.splunk.com/Documentation/Splunk/6.2.1/Knowledge/definecalcfields

0 Karma

wpreston
Motivator

Can you share your props.conf and transforms.conf lines for the PAYXLINE_MV field?

0 Karma

_d_
Splunk Employee
Splunk Employee

Well, in your first two statements you're evaluating PAYXLINE_MV2 on the first and then calling it again on the second. Calculated fields are evaluated in parallel and not in sequence; i.e. PAYXLINE_MV2 is not availalbe to the 2nd statement when it tries to execute. Try something like this:

EVAL-PAYXLINEGLOB=mvjoin(mvindex(PAYXLINE_MV,N,-1)," ")

n00b
Explorer

This comment about it happening in parallel vs in order fixed an issue I had for days!

0 Karma

tsawant
New Member

Not working I tried doing that previously.

0 Karma

_d_
Splunk Employee
Splunk Employee

That should work if 'PAYXLINE_MV' is indeed a multivalued field and 'N' is a number.

0 Karma

tsawant
New Member

yea its a multivalued field and N is number

0 Karma

_d_
Splunk Employee
Splunk Employee

In addition to being a number, N needs to be within the range of the length of the multivalued field.

0 Karma

tsawant
New Member

mvjoin works perfectly in props.conf right ?

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...