CASE command in Props.conf

[pavanbmishra]

Hello SMEs....Seeking helping hand

I got stuck while putting EVAL-<field-name> in props.conf using case command and it is not at all working while the same is working in search bar in GUI. As suggestion would be highly appreciated

EVAL-XYZ = case(src== "AAA", field1, src== "BBB", field2 , src== "CCC", field3)

[s2_splunk · Accepted solution]

I would suggest to add a default option at the end to see whether this eval just doesn't match any of your options (or your sourcetype?) and go from there. Generally, it looks correct. Case-sensitivity for field names is my only idea. Try this and see if you at least get your field with the default value: 

EVAL-XYZ = case(src="AAA", field1, src="BBB", field2 , src="CCC", field3, 1=1, "HITTING DEFAULT IN EVAL")

 If this doesn't help and you can, please post your exact props.conf file

[Vardhan]

HI @pavanbmishra,

The eval -xyz filed name have you used anywhere else in the same props. conf? And where exactly have you placed the props. conf? 

[pavanbmishra]

Thanks Vardhan for your quick help 🙂

No i am not using that eval-xyz field anywhere in the props.conf, i put my config file under below folder

/etc/apps/<app-name>/local folder 

[Vardhan]

Hi @pavanbmishra,

Did you verify the local.meta of your apps folder? And also the after placing the props.conf in search head can you quickly restart and check if it is a single instance. For distributed search head cluster no restart required.

The only eval is not working all other fields are working fine?

[pavanbmishra]

Yeah all filed working except that eval expression. What should i check under local.meta ?

BTW it is single instance and i restarted that also. Thanks 🙂

[Vardhan]

Hi @pavanbmishra ,

Can you try with the below eval and see the result.

EVAL-XYZ = case(src== "AAA", "field1", src== "BBB", "field2" , src== "CCC", "field3")

And also make sure you are able to see the mentioned src fields values in the case.