Splunk Search

CASE command in Props.conf

pavanbmishra
Path Finder

Hello SMEs....Seeking helping hand

I got stuck while putting EVAL-<field-name> in props.conf using case command and it is not at all working while the same is working in search bar in GUI. As suggestion would be highly appreciated

 

EVAL-XYZ = case(src== "AAA", field1, src== "BBB", field2 , src== "CCC", field3)

Labels (1)
Tags (1)
0 Karma
1 Solution

s2_splunk
Splunk Employee
Splunk Employee

I would suggest to add a default option at the end to see whether this eval just doesn't match any of your options (or your sourcetype?) and go from there. Generally, it looks correct. Case-sensitivity for field names is my only idea. Try this and see if you at least get your field with the default value: 

 

EVAL-XYZ = case(src="AAA", field1, src="BBB", field2 , src="CCC", field3, 1=1, "HITTING DEFAULT IN EVAL")

 

 If this doesn't help and you can, please post your exact props.conf file

View solution in original post

s2_splunk
Splunk Employee
Splunk Employee

I would suggest to add a default option at the end to see whether this eval just doesn't match any of your options (or your sourcetype?) and go from there. Generally, it looks correct. Case-sensitivity for field names is my only idea. Try this and see if you at least get your field with the default value: 

 

EVAL-XYZ = case(src="AAA", field1, src="BBB", field2 , src="CCC", field3, 1=1, "HITTING DEFAULT IN EVAL")

 

 If this doesn't help and you can, please post your exact props.conf file

View solution in original post

Vardhan
Communicator

HI @pavanbmishra,

The eval -xyz filed name have you used anywhere else in the same props. conf? And where exactly have you placed the props. conf? 

 

0 Karma

pavanbmishra
Path Finder

Thanks Vardhan for your quick help 🙂

No i am not using that eval-xyz field anywhere in the props.conf, i put my config file under below folder

/etc/apps/<app-name>/local folder 

0 Karma

Vardhan
Communicator

Hi @pavanbmishra,

 

Did you verify the local.meta of your apps folder? And also the after placing the props.conf in search head can you quickly restart and check if it is a single instance. For distributed search head cluster no restart required.

The only eval is not working all other fields are working fine?

0 Karma

pavanbmishra
Path Finder

Yeah all filed working except that eval expression. What should i check under local.meta ?

BTW it is single instance and i restarted that also. Thanks 🙂

0 Karma

Vardhan
Communicator

Hi @pavanbmishra ,

Can you try with the below eval and see the result.

EVAL-XYZ = case(src== "AAA", "field1", src== "BBB", "field2" , src== "CCC", "field3")

And also make sure you are able to see the mentioned src fields values in the case.

0 Karma

Tune In & Win!

Don't miss out on your
chance to take home free
prizes by helping our players
save the Splunk Cloudom!

Dungeons & Data
Monsters: Splunk O11y
Day Editions Games
stream live:
5/4 at 6:30pm PST
5/5 at 7:00pm PST
on