I've extracted a field called QR from a sourcetype, and it's working perfectly, but is returning numerical data, and I need specific words for a Enterprise Security dashboard to work. When I type the following eval command into the search bar it works perfectly, but when I place it in props.conf it doesn't execute correctly (new field is not created):
sourcetype = MSAD:NT6:DNS | eval message_type = if(QR==0, "RESPONSE", "QUERY")
I'm wondering if I'm running into an order of precedence issue, where my EVAL is kicking off before a QR field is even created.
I have the following in my transforms and props files.
[MSAD:NT6:DNS] [dns_qr_extraction] REGEX = (QR)\s+(\d) FORMAT = $1::$2
[MSAD:NT6:DNS] REPORT-dns_qr_extraction = dns_qr_extraction EVAL message_type = if(QR==0, "RESPONSE", QR==1, "QUERY", "UNKNOWN")
You are missing a hyphen, try this:
EVAL-message_type = if(QR==0, "RESPONSE", QR==1, "QUERY", "UNKNOWN)
This mistake should have caused Splunk to give you an error every time you restart Splunk (which you probably did) so be sure to pay attention to the output EVERY time you restart Splunk!
You do see that I changed
EVAL message_type to
EVAL-message_type, right? I ask because you fixed your question (which I reformatted for clarity) for the other "wrong" answer but not for this one. Is perhaps this the actual problem?