Splunk Search

How to use calculated field with url?

Path Finder

Hello,

I'm trying to use calculated field on data with url field. Simple doesn't work. Even a very simple 'upper(url)' doesn't work.
If I'm doing |eval upper(url) it works perfect.
Is there any known restriction which I didn't see somewhere in the documentation?

Please note that the search is done on 7.0.3 fresh installation (literally nothing installed)

0 Karma
1 Solution

Path Finder

Unfortunately for me (because is kind of shame) I found the issue and it was with the browser sessions. By luck closing and re-opening the browser all my changes were working which is not ideal

View solution in original post

0 Karma

Path Finder

Unfortunately for me (because is kind of shame) I found the issue and it was with the browser sessions. By luck closing and re-opening the browser all my changes were working which is not ideal

View solution in original post

0 Karma

SplunkTrust
SplunkTrust

Hi @a_naoum,

This is due to the permissions of your app and your calculated field and whether the configuration is set to private, app or global.

If you created your calculated field in app A and this app doesn't export its configuration then you won't be able to see that calculated field in app B or search app. Same if you created it with user X and the permissions are set to private, then user Y won't be able to see it.

Please check the configurations and make sure you're in the right app when testing your field.

Refer here for basic permission configs :
https://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Manageknowledgeobjectpermissions

Cheers,
David

0 Karma

Path Finder

I done the changes on props.conf of the app as I mention to someone, so in that case there is no permissions issue.
Anyway, case solved. Browser

0 Karma

SplunkTrust
SplunkTrust

Is the url an extracted field?? Do you see it in field sidebar?

0 Karma

Path Finder

yes, it is. The specific events are simple KV with '=' separated fields

0 Karma

Motivator

@a_naoum - Please clarify first part your question, where you are saying upper(url) is not working?

0 Karma

Path Finder

correct. I done the same via GUI and props.conf. If I do the same 'upper' on a different field, it works. It is hard to miss the field name (it is just... url)

0 Karma

Motivator

Is it not working in props.conf or in search or in datamodel?

0 Karma

Path Finder

I said not. Datamodel is not used but I don't need to for now.

0 Karma

Motivator

Can you tell where url field is coming from? If url it self is evaluated somewhere else in props.conf this will not work as all eval executes in parallel.

0 Karma