Splunk Enterprise Security
Highlighted

Calculated field always evaluates to zero

Explorer

Hi All

I am attempting to create a field called app for Enterprise Security based off of Cisco WSA Squid logs

To create the field, I use a field alias of the sourcetype to fill the value of app

Next I am trying to use a calculated field to determine to final value app=case(app="cisco:wsa:squid","squid")

Testing this in a basic search works fine sourcetype=cisco:wsa:squid | eval app=case(app="cisco:wsa:squid","squid") | table _time, app

But using that search as a calculated field always evaluates to zero.

Anyone have any idea why?

0 Karma
Highlighted

Re: Calculated field always evaluates to zero

SplunkTrust
SplunkTrust

I have two queries.
1) what eval expression you have configured . can you give the artifacts of local/props.conf where this calculated field configuration is.
2) Try making calculated field permissions to global.

Highlighted

Re: Calculated field always evaluates to zero

Explorer

1) I used the Splunk Web interface. The eval expression used was app=case(app="cisco:wsa:squid","squid")
2) Permission have been set to global

0 Karma
Highlighted

Re: Calculated field always evaluates to zero

SplunkTrust
SplunkTrust

You need to write only case(app="cisco:wsa:squid","squid") in the eval expression. Field name you have to specify in Name.

View solution in original post

Highlighted

Re: Calculated field always evaluates to zero

Explorer

Thanks that worked perfectly

0 Karma
Highlighted

Re: Calculated field always evaluates to zero

SplunkTrust
SplunkTrust

I have converted my comment to an answer. If you deem a posted answer as valid and helpful to your solving of the issue, please accept said answer so that this question no longer appears open.

0 Karma