Getting Data In

Why are mvindex and mvjoin not working while using eval to define calculated fields in props.conf?

tsawant
New Member

Here's a quick question I am trying to implement calculated fields in props.conf using EVAL command following is the code that I am trying to implement:

EVAL-PAYXLINE_MV2=mvindex(PAYXLINE_MV,N,-1) 
EVAL-PAYXLINEGLOB=mvjoin(PAYXLINE_MV2," ")
EVAL-PAYXHASH=sha256(mvjoin(PAYXLINE_MV," "))

The problem is I am not able to get the first 2 commands working when I put mvindex and mvjoin directly but it works perfectly fine when I use mvjoin with sha256. Can you help me to solve this problem. Here is the documentation that I am following to define fields in props.conf.
http://docs.splunk.com/Documentation/Splunk/6.2.1/Knowledge/definecalcfields

0 Karma

wpreston
Motivator

Can you share your props.conf and transforms.conf lines for the PAYXLINE_MV field?

0 Karma

_d_
Splunk Employee
Splunk Employee

Well, in your first two statements you're evaluating PAYXLINE_MV2 on the first and then calling it again on the second. Calculated fields are evaluated in parallel and not in sequence; i.e. PAYXLINE_MV2 is not availalbe to the 2nd statement when it tries to execute. Try something like this:

EVAL-PAYXLINEGLOB=mvjoin(mvindex(PAYXLINE_MV,N,-1)," ")

n00b
Explorer

This comment about it happening in parallel vs in order fixed an issue I had for days!

0 Karma

tsawant
New Member

Not working I tried doing that previously.

0 Karma

_d_
Splunk Employee
Splunk Employee

That should work if 'PAYXLINE_MV' is indeed a multivalued field and 'N' is a number.

0 Karma

tsawant
New Member

yea its a multivalued field and N is number

0 Karma

_d_
Splunk Employee
Splunk Employee

In addition to being a number, N needs to be within the range of the length of the multivalued field.

0 Karma

tsawant
New Member

mvjoin works perfectly in props.conf right ?

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Take Action Automatically on Splunk Alerts with Red Hat Ansible Automation Platform

 Are you ready to revolutionize your IT operations? As digital transformation accelerates, the demand for ...

Calling All Security Pros: Ready to Race Through Boston?

Hey Splunkers, .conf25 is heading to Boston and we’re kicking things off with something bold, competitive, and ...

Beyond Detection: How Splunk and Cisco Integrated Security Platforms Transform ...

Financial services organizations face an impossible equation: maintain 99.9% uptime for mission-critical ...