I am trying to add new evaluation for a field in search-time.
For some reason, when I run query from my search head, I get the old values and it seems that the props.conf is not working.
Here is my configuration:
EVAL-action = if(isnull(action), action, if(eventtype == "Intrusion_Detection", if(action IN ("Accept", "Detect", "Allow"),"allowed", "blocked"),action))
If i copy the above line to the search bar, it works OK.
Must mention that I modified props.conf under default directory.
What am I missing here?
Update - I found out that I have 2 EVAL for the same field - does it look only for the last one or do everything in order?
If one interferes with the other yes you might have problems. See this link for file precedences: https://docs.splunk.com/Documentation/Splunk/8.0.1/Admin/Wheretofindtheconfigurationfiles
You might also need to wait the knowledge bundle to be deployed to the indexers before you can see the configuration working (which might take a few minutes)