Hello SMEs....Seeking helping hand
I got stuck while putting EVAL-<field-name> in props.conf using case command and it is not at all working while the same is working in search bar in GUI. As suggestion would be highly appreciated
EVAL-XYZ = case(src== "AAA", field1, src== "BBB", field2 , src== "CCC", field3)
I would suggest to add a default option at the end to see whether this eval just doesn't match any of your options (or your sourcetype?) and go from there. Generally, it looks correct. Case-sensitivity for field names is my only idea. Try this and see if you at least get your field with the default value:
EVAL-XYZ = case(src="AAA", field1, src="BBB", field2 , src="CCC", field3, 1=1, "HITTING DEFAULT IN EVAL")
If this doesn't help and you can, please post your exact props.conf file
I would suggest to add a default option at the end to see whether this eval just doesn't match any of your options (or your sourcetype?) and go from there. Generally, it looks correct. Case-sensitivity for field names is my only idea. Try this and see if you at least get your field with the default value:
EVAL-XYZ = case(src="AAA", field1, src="BBB", field2 , src="CCC", field3, 1=1, "HITTING DEFAULT IN EVAL")
If this doesn't help and you can, please post your exact props.conf file
HI @pavanbmishra,
The eval -xyz filed name have you used anywhere else in the same props. conf? And where exactly have you placed the props. conf?
Thanks Vardhan for your quick help 🙂
No i am not using that eval-xyz field anywhere in the props.conf, i put my config file under below folder
/etc/apps/<app-name>/local folder
Hi @pavanbmishra,
Did you verify the local.meta of your apps folder? And also the after placing the props.conf in search head can you quickly restart and check if it is a single instance. For distributed search head cluster no restart required.
The only eval is not working all other fields are working fine?
Yeah all filed working except that eval expression. What should i check under local.meta ?
BTW it is single instance and i restarted that also. Thanks 🙂
Hi @pavanbmishra ,
Can you try with the below eval and see the result.
EVAL-XYZ = case(src== "AAA", "field1", src== "BBB", "field2" , src== "CCC", "field3")
And also make sure you are able to see the mentioned src fields values in the case.