Getting Data In
Highlighted

Why are mvindex and mvjoin not working while using eval to define calculated fields in props.conf?

New Member

Here's a quick question I am trying to implement calculated fields in props.conf using EVAL command following is the code that I am trying to implement:

EVAL-PAYXLINE_MV2=mvindex(PAYXLINE_MV,N,-1) 
EVAL-PAYXLINEGLOB=mvjoin(PAYXLINE_MV2," ")
EVAL-PAYXHASH=sha256(mvjoin(PAYXLINE_MV," "))

The problem is I am not able to get the first 2 commands working when I put mvindex and mvjoin directly but it works perfectly fine when I use mvjoin with sha256. Can you help me to solve this problem. Here is the documentation that I am following to define fields in props.conf.
http://docs.splunk.com/Documentation/Splunk/6.2.1/Knowledge/definecalcfields

0 Karma
Highlighted

Re: Why are mvindex and mvjoin not working while using eval to define calculated fields in props.conf?

Splunk Employee
Splunk Employee

Well, in your first two statements you're evaluating PAYXLINEMV2 on the first and then calling it again on the second. Calculated fields are evaluated in parallel and not in sequence; i.e. PAYXLINEMV2 is not availalbe to the 2nd statement when it tries to execute. Try something like this:

EVAL-PAYXLINEGLOB=mvjoin(mvindex(PAYXLINE_MV,N,-1)," ")

0 Karma
Highlighted

Re: Why are mvindex and mvjoin not working while using eval to define calculated fields in props.conf?

New Member

Not working I tried doing that previously.

0 Karma
Highlighted

Re: Why are mvindex and mvjoin not working while using eval to define calculated fields in props.conf?

Splunk Employee
Splunk Employee

That should work if 'PAYXLINE_MV' is indeed a multivalued field and 'N' is a number.

0 Karma
Highlighted

Re: Why are mvindex and mvjoin not working while using eval to define calculated fields in props.conf?

Splunk Employee
Splunk Employee

In addition to being a number, N needs to be within the range of the length of the multivalued field.

0 Karma
Highlighted

Re: Why are mvindex and mvjoin not working while using eval to define calculated fields in props.conf?

New Member

mvjoin works perfectly in props.conf right ?

0 Karma
Highlighted

Re: Why are mvindex and mvjoin not working while using eval to define calculated fields in props.conf?

New Member

yea its a multivalued field and N is number

0 Karma
Highlighted

Re: Why are mvindex and mvjoin not working while using eval to define calculated fields in props.conf?

Motivator

Can you share your props.conf and transforms.conf lines for the PAYXLINE_MV field?

0 Karma