Splunk Search

CASE command in Props.conf

pavanbmishra
Path Finder

Hello SMEs....Seeking helping hand

I got stuck while putting EVAL-<field-name> in props.conf using case command and it is not at all working while the same is working in search bar in GUI. As suggestion would be highly appreciated

 

EVAL-XYZ = case(src== "AAA", field1, src== "BBB", field2 , src== "CCC", field3)

Labels (1)
Tags (1)
0 Karma
1 Solution

s2_splunk
Splunk Employee
Splunk Employee

I would suggest to add a default option at the end to see whether this eval just doesn't match any of your options (or your sourcetype?) and go from there. Generally, it looks correct. Case-sensitivity for field names is my only idea. Try this and see if you at least get your field with the default value: 

 

EVAL-XYZ = case(src="AAA", field1, src="BBB", field2 , src="CCC", field3, 1=1, "HITTING DEFAULT IN EVAL")

 

 If this doesn't help and you can, please post your exact props.conf file

View solution in original post

s2_splunk
Splunk Employee
Splunk Employee

I would suggest to add a default option at the end to see whether this eval just doesn't match any of your options (or your sourcetype?) and go from there. Generally, it looks correct. Case-sensitivity for field names is my only idea. Try this and see if you at least get your field with the default value: 

 

EVAL-XYZ = case(src="AAA", field1, src="BBB", field2 , src="CCC", field3, 1=1, "HITTING DEFAULT IN EVAL")

 

 If this doesn't help and you can, please post your exact props.conf file

Vardhan
Contributor

HI @pavanbmishra,

The eval -xyz filed name have you used anywhere else in the same props. conf? And where exactly have you placed the props. conf? 

 

0 Karma

pavanbmishra
Path Finder

Thanks Vardhan for your quick help 🙂

No i am not using that eval-xyz field anywhere in the props.conf, i put my config file under below folder

/etc/apps/<app-name>/local folder 

0 Karma

Vardhan
Contributor

Hi @pavanbmishra,

 

Did you verify the local.meta of your apps folder? And also the after placing the props.conf in search head can you quickly restart and check if it is a single instance. For distributed search head cluster no restart required.

The only eval is not working all other fields are working fine?

0 Karma

pavanbmishra
Path Finder

Yeah all filed working except that eval expression. What should i check under local.meta ?

BTW it is single instance and i restarted that also. Thanks 🙂

0 Karma

Vardhan
Contributor

Hi @pavanbmishra ,

Can you try with the below eval and see the result.

EVAL-XYZ = case(src== "AAA", "field1", src== "BBB", "field2" , src== "CCC", "field3")

And also make sure you are able to see the mentioned src fields values in the case.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...