EVAL issue

[jsmith39]

I've extracted a field called QR from a sourcetype, and it's working perfectly, but is returning numerical data, and I need specific words for a Enterprise Security dashboard to work. When I type the following eval command into the search bar it works perfectly, but when I place it in props.conf it doesn't execute correctly (new field is not created):

sourcetype = MSAD:NT6:DNS | eval message_type = if(QR==0, "RESPONSE", "QUERY")

I'm wondering if I'm running into an order of precedence issue, where my EVAL is kicking off before a QR field is even created.
I have the following in my transforms and props files.

transforms.conf

[MSAD:NT6:DNS]
[dns_qr_extraction]
REGEX = (QR)\s+(\d)
FORMAT = $1::$2

props.conf

[MSAD:NT6:DNS]
REPORT-dns_qr_extraction = dns_qr_extraction
EVAL message_type = if(QR==0, "RESPONSE", QR==1, "QUERY", "UNKNOWN")

[woodcock]

Is the QR field being crated for sure?

... | fields QR

[woodcock]

You also have a mismatch in your props.conf stanza header: [dns_qr_lookup_action] should be [dns_qr_extraction].

[jsmith39]

Again, just being clumsy when putting my question on this website, in my server files, everything is typed correctly.

[woodcock]

You are missing a hyphen, try this:

EVAL-message_type = if(QR==0, "RESPONSE", QR==1, "QUERY", "UNKNOWN)

This mistake should have caused Splunk to give you an error every time you restart Splunk (which you probably did) so be sure to pay attention to the output EVERY time you restart Splunk!

[jsmith39]

That was a format issue when I was typing into answers.splunk.com, thanks for replying though appreciate the thought.

[woodcock]

You do see that I changed EVAL message_type to EVAL-message_type, right? I ask because you fixed your question (which I reformatted for clarity) for the other "wrong" answer but not for this one. Is perhaps this the actual problem?

[jsmith39]

Thank you, you're right, I did miss turning EVAL message_type into EVAL-message_type.
Unfortunately this still isn't having the desired effect of creating a message_type field.

[woodcock]

You also do not need [MSAD:NT6:DNS] in transforms.conf so remove that.