Hi
I am having an issue with deleting/editing calculated fields in Splunk Web. Any idea, how I can remove these two?
The name is like this:
csv : EVALTYPE : EVAL A
csv : EVALTYPE : EVAL B
They are for different field names and have the same eval expression.
I think Splunk does not like the use of : two times because I have created a third calculated filed with only one : and was able to remove it easily.
Error I am getting:
Deleting:
Error occurred attempting to remove csv : EVALTYPE : EVALTYPE: In handler 'props-eval': Object 'csv : EVALTYPE : EVALTYPE' does not exist in user=aaa, app=bbb: props.conf [csv] EVALTYPE : EVALTYPE.
Changing permission:
Splunk could not update permissions for resource data/props/calcfields [HTTP 409] [{'type': 'ERROR', 'code': None, 'text': 'No eligible entity'}]
Editing:
Encountered the following error while trying to update: In handler 'props-eval': Object 'csv : EVALTYPE : EVALTYPE' does not exist in user=aaa, app=bbb: props.conf [rnw-csv] EVALTYPE : EVALTYPE
thank you
