For a field user, which has precedence: an eval defined in local folder or a regex defined in default folder?

[skender27]

Hi,

I am having the following issue/conflict when resolving the field user from events (coming with sourcetype WinEventLog:Application):

Actually the implementation has one regex with report stanza defined in: ..\etc\apps\my_app\default\transforms.conf

like this:

[USERID_text]
FORMAT = USERID::$1
REGEX = USERID[\s*]?\:\[?\d*\]?\s+["|']?([^'"]*)

and so in props.conf I get props.conf:
REPORT-USERID_text = USERID_text

And in the ..\etc\apps\my_app\local\props.conf I have an eval:

[WinEventLog:Application]
EVAL-user = ...etc...smth...

Which of them has the priority?

Does the eval has the precedence over the regex?

Thanks a lot,
Skender

[woodcock]

It is whichever happens last.
http://docs.splunk.com/Documentation/Splunk/6.5.2/Knowledge/Searchtimeoperationssequence

You cannot change the order of operations but you can change the method of your modification. Many of these operations can be twisted to do the same thing as one of the others and this conversion will move it to a different position in the order. This is the order:

INDEXED_EXTRACTIONS -> SEDCMD -> TRANSFORMS <---###Transition from Index-Time to Search-Time###---> EXTRACT -> REPORT -> KV_MODE -> FIELDALIAS -> EVAL -> LOOKUP -> EVENTTYPING -> TAGGING

Actually, I am not absolutely certain about the order of the first 2.

[skender27]

Hi,

I added an alias for user field to normalize knowledge objects.
The problem was that fieldalias was not working because there was another eval which returned NULL value for field user.
So I used another eval for user field, but this time with the coalesce attribute.

Thanks anyway for your suggestion,
Skender

[aaraneta_splunk]

Hi @skender27 - Is this a working solution to your question? If yes, please don't forget to click "Accept" below your answer to resolve and close out your post. Thank you!

[gcusello]

Hi skender27,

This is a graphic representation of Search Time Order.

Bye.
Giuseppe