Calculated field always evaluates to zero

[davidmonaghan]

Hi All

I am attempting to create a field called app for Enterprise Security based off of Cisco WSA Squid logs

To create the field, I use a field alias of the sourcetype to fill the value of app

Next I am trying to use a calculated field to determine to final value app=case(app="cisco:wsa:squid","squid")

Testing this in a basic search works fine sourcetype=cisco:wsa:squid | eval app=case(app="cisco:wsa:squid","squid") | table _time, app

But using that search as a calculated field always evaluates to zero.

Anyone have any idea why?

[mayurr98 · Accepted solution]

You need to write only case(app="cisco:wsa:squid","squid") in the eval expression. Field name you have to specify in Name.

[davidmonaghan]

Thanks that worked perfectly

[mayurr98]

I have converted my comment to an answer. If you deem a posted answer as valid and helpful to your solving of the issue, please accept said answer so that this question no longer appears open.

[davidmonaghan]

1) I used the Splunk Web interface. The eval expression used was app=case(app="cisco:wsa:squid","squid")
2) Permission have been set to global

[mayurr98]

I have two queries.
1) what eval expression you have configured . can you give the artifacts of local/props.conf where this calculated field configuration is.
2) Try making calculated field permissions to global.