I am attempting to create a field called app for Enterprise Security based off of Cisco WSA Squid logs
To create the field, I use a field alias of the sourcetype to fill the value of app
Next I am trying to use a calculated field to determine to final value
Testing this in a basic search works fine
sourcetype=cisco:wsa:squid | eval app=case(app="cisco:wsa:squid","squid") | table _time, app
But using that search as a calculated field always evaluates to zero.
Anyone have any idea why?
I have two queries.
1) what eval expression you have configured . can you give the artifacts of
local/props.conf where this calculated field configuration is.
2) Try making calculated field permissions to global.
1) I used the Splunk Web interface. The eval expression used was
2) Permission have been set to global
You need to write only
case(app="cisco:wsa:squid","squid") in the eval expression. Field name you have to specify in Name.
I have converted my comment to an answer. If you deem a posted answer as valid and helpful to your solving of the issue, please accept said answer so that this question no longer appears open.