- Find Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- Why is my EVAL configuration in props.conf on the ...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I'm working with data that is being sent from a universal forwarder (UF) on the server. I do an INDEXED_EXTRACTION in the props.conf on the universal forwarder. When I search for the data on the search head (SH) it is put into the correct fields. I also have EVALs in the props.conf on the SH. What I don't see is the EVALs processed. This EVALS were processed in my standalone dev laptop, but not in the distributed environment. Do I need to move the EVALs to the UF?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
There are days. I had a meeting with the rest of the team and my issue was due to our distributed environment. The TA got pushed to the UF, but not to the SH. Once it was pushed to the SH, the problem resolved itself.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
There are days. I had a meeting with the rest of the team and my issue was due to our distributed environment. The TA got pushed to the UF, but not to the SH. Once it was pushed to the SH, the problem resolved itself.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Do post your relevant configuration, e.g. the props.conf defining the eval, some sample events, the searches you are running, etc.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
No, the EVAL (calculated fields) are search time field extraction and should be on SH. Can you check if those EVAL have sharing permissions Global and allows read to your user role (or everyone)?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The sharing permission is global. The permissions are everyone:read, admin:write, and power:write.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
what is the full path to file for this particular props.conf?
how your distributed environment looks like?
try and place the props.conf on the indexer as well.
hope it helps
Enterprise Security Content Update (ESCU) | New Releases
Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?
Index This | What are the 12 Days of Splunk-mas?
