Why am I unable to delete calculated fields from Splunk Web?

[akawacz]

Hi

I am having an issue with deleting/editing calculated fields in Splunk Web. Any idea, how I can remove these two?

The name is like this:

csv : EVALTYPE : EVAL A
csv : EVALTYPE : EVAL B

They are for different field names and have the same eval expression.

I think Splunk does not like the use of : two times because I have created a third calculated filed with only one : and was able to remove it easily.

Error I am getting:
Deleting:

Error occurred attempting to remove csv : EVALTYPE : EVALTYPE: In handler 'props-eval': Object 'csv : EVALTYPE : EVALTYPE' does not exist in user=aaa, app=bbb: props.conf [csv] EVALTYPE : EVALTYPE.

Changing permission:

Splunk could not update permissions for resource data/props/calcfields [HTTP 409] [{'type': 'ERROR', 'code': None, 'text': 'No eligible entity'}]

Editing:

Encountered the following error while trying to update: In handler 'props-eval': Object 'csv : EVALTYPE : EVALTYPE' does not exist in user=aaa, app=bbb: props.conf [rnw-csv] EVALTYPE : EVALTYPE

thank you

[woodcock · Accepted solution]

Open a support case to report the bug and manually edit the props.conf file with CLI.

[layamba]

Did anyone ever open a support case to report this? I just had same issue with 7.0.0.