Hi All
I am attempting to create a field called app for Enterprise Security based off of Cisco WSA Squid logs
To create the field, I use a field alias of the sourcetype to fill the value of app
Next I am trying to use a calculated field to determine to final value app=case(app="cisco:wsa:squid","squid")
Testing this in a basic search works fine sourcetype=cisco:wsa:squid | eval app=case(app="cisco:wsa:squid","squid") | table _time, app
But using that search as a calculated field always evaluates to zero.
Anyone have any idea why?
You need to write only case(app="cisco:wsa:squid","squid")
in the eval expression. Field name you have to specify in Name.
You need to write only case(app="cisco:wsa:squid","squid")
in the eval expression. Field name you have to specify in Name.
Thanks that worked perfectly
I have converted my comment to an answer. If you deem a posted answer as valid and helpful to your solving of the issue, please accept said answer so that this question no longer appears open.
1) I used the Splunk Web interface. The eval expression used was app=case(app="cisco:wsa:squid","squid")
2) Permission have been set to global
I have two queries.
1) what eval expression you have configured . can you give the artifacts of local/props.conf
where this calculated field configuration is.
2) Try making calculated field permissions to global.