Issues with props.conf and EVAL function

[shayhibah]

Hi,

I am trying to add new evaluation for a field in search-time.
For some reason, when I run query from my search head, I get the old values and it seems that the props.conf is not working.

Here is my configuration:

EVAL-action = if(isnull(action), action, if(eventtype == "Intrusion_Detection", if(action IN ("Accept", "Detect", "Allow"),"allowed", "blocked"),action))

If i copy the above line to the search bar, it works OK.

Must mention that I modified props.conf under default directory.

What am I missing here?

Update - I found out that I have 2 EVAL for the same field - does it look only for the last one or do everything in order?

[gfreitas]

If one interferes with the other yes you might have problems. See this link for file precedences: https://docs.splunk.com/Documentation/Splunk/8.0.1/Admin/Wheretofindtheconfigurationfiles

You might also need to wait the knowledge bundle to be deployed to the indexers before you can see the configuration working (which might take a few minutes)