props.conf not showing the output using EVAL

[sureshkumaar]

Below is props.conf for a sourcetype, where we getting results for raw_action and tag1 fields.

But considering/based upon the inputs received from raw_action and tag1 while we try to get the result for the field "action" receiving BLANK results.

Kindly someone help

EXTRACT-raw_action = (?<raw_action>Failed|Stopped|Deactivated|Login failed|USER_LOGGED_OUT|Logged out|Accepted|Log
ged in|USER_LOGGED_IN|dnf-makecache.service: Succeeded|TASK_FINISHED|modified|acl_modified|Succeeded|success=yes|Link is Up|repaired|allowed|receive)

EVAL-tag1 = case(match(raw_action,"(?i)\b(Failed|Stopped|Deactivated|Login failed|USER_LOGGED_OUT|Logged out)\b"),"authentication", match(raw_action,"(?i)\b(Accepted|Logged in|USER_LOGGED_IN)\b"),"authentication", match(raw_action,"(?i)\b(dnf-makecache.service: Succeeded)\b"),"change", match(raw_action,"(?i)\b(TASK_FINISHED|modified|acl_modified|Succeeded)\b"),"change", match(raw_action,"(?i)\b(success=yes|Link is Up|repaired|allowed|receive)\b"),"network")

EVAL-action = case(tag1=="authentication" AND match(raw_action,"(?i)(Failed|Stopped|Deactivated|Login failed|USER_LOGGED_OUT|Logged out)"),"failure", tag1=="authentication" AND match(raw_action,"(?i)(Accepted|Logged in|USER_LOGGED_IN)"),"success", tag1=="change" AND match(raw_action,"(?i)(dnf-makecache.service:Succeeded)"),"modified", tag1=="change" AND match(raw_action,"(?i)(TASK_FINISHED|modified|acl_modified|Succeeded)"),"modified", tag1=="network" AND match(raw_action,"(?i)(success=yes|Link is Up|repaired|allowed|receive)"),"allowed")

[PickleRick]

https://help.splunk.com/en/splunk-enterprise/manage-knowledge-objects/knowledge-management-manual/9.... 

Restrictions

All EVAL-<fieldname> configurations within a single props.conf stanza are processed in parallel instead of sequentially. This means you can't chain together calculated field expressions where the evaluation of one calculated field is used in the expression for the next calculated field.

[livehybrid]

Hi @sureshkumaar 

You cannot reference a field generated by an EVAL statement (like tag1) inside another EVAL statement (like action) within the same props.conf stanza. All EVAL statements in a stanza run effectively in parallel based on the extracted fields, not sequentially based on each other's output.

To fix this, remove the dependency on tag1 inside EVAL-action and rely solely on raw_action. Since raw_action is extracted via EXTRACT (which runs before EVAL), it is available for use. (See https://help.splunk.com/en/splunk-enterprise/manage-knowledge-objects/knowledge-management-manual/10...) 

Additionally, there is a typo in your original EVAL-action regex: dnf-makecache.service:Succeeded is missing the space that exists in EVAL-tag1 (dnf-makecache.service: Succeeded).

Try this:

EXTRACT-raw_action = (?<raw_action>Failed|Stopped|Deactivated|Login failed|USER_LOGGED_OUT|Logged out|Accepted|Log\s*ged in|USER_LOGGED_IN|dnf-makecache.service: Succeeded|TASK_FINISHED|modified|acl_modified|Succeeded|success=yes|Link is Up|repaired|allowed|receive)

EVAL-tag1 = case(match(raw_action,"(?i)\b(Failed|Stopped|Deactivated|Login failed|USER_LOGGED_OUT|Logged out)\b"),"authentication", match(raw_action,"(?i)\b(Accepted|Logged in|USER_LOGGED_IN)\b"),"authentication", match(raw_action,"(?i)\b(dnf-makecache.service: Succeeded)\b"),"change", match(raw_action,"(?i)\b(TASK_FINISHED|modified|acl_modified|Succeeded)\b"),"change", match(raw_action,"(?i)\b(success=yes|Link is Up|repaired|allowed|receive)\b"),"network")

EVAL-action = case(match(raw_action,"(?i)(Failed|Stopped|Deactivated|Login failed|USER_LOGGED_OUT|Logged out)"),"failure", match(raw_action,"(?i)(Accepted|Logged in|USER_LOGGED_IN)"),"success", match(raw_action,"(?i)(dnf-makecache.service: Succeeded)"),"modified", match(raw_action,"(?i)(TASK_FINISHED|modified|acl_modified|Succeeded)"),"modified", match(raw_action,"(?i)(success=yes|Link is Up|repaired|allowed|receive)"),"allowed")

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing