Getting Data In
Highlighted

Why is eval in props.conf not performing in a particular order?

Explorer

Below is my props.conf stanza please check I'm getting all fields except uid, even the url field which has similar extraction mechanism.

[mysourcetype]
....
EVAL-message
id = mid
EVAL-url = substr(xurl, 0, 15)
EVAL-uid = substr(message_id, 0, 5)

0 Karma
Highlighted

Re: Why is eval in props.conf not performing in a particular order?

Ultra Champion

Evals are not performed in any particular order. You cannot do an eval that depends on another eval.

You will need do EVAL-uid = substr(mid, 0, 5).

Or replace EVAL-message_id = mid by FIELDALIAS-mid_as_message_id = mid AS message_id. Field aliasing is performed after field extraction, but before calculated fields (EVAL-* statements), so you can use the message_id alias in your EVAL-uid.

Highlighted

Re: Why is eval in props.conf not performing in a particular order?

Explorer

I understand that all EVALs don't have any order.

0 Karma
Highlighted

Re: Why is eval in props.conf not performing in a particular order?

Motivator

Hello @atulpatel
Try this:

[my_sourcetype]
....
EVAL-message_id = mid
EVAL-url = substr(xurl, 0, 15)
EVAL-uid = substr(mid, 0, 5)

In your case it is not working because in props.conf all EVALs in a stanza execute parallel.

Hope this helps!!!

View solution in original post

Highlighted

Re: Why is eval in props.conf not performing in a particular order?

Explorer

Yeah I got it.

0 Karma