Splunk Search

ingest-time eval (creating new field dynamically on index time) not working

agro1986001
Engager

Hi. I tried the ingest-time eval documentation at (single enterprise instance):
https://docs.splunk.com/Documentation/Splunk/7.2.3/Data/IngestEval

However I could find the new field from the "| table eval_user" pipe. Does anyone have any experience in making it work? Thanks a lot

Tags (2)
0 Karma

woodcock
Esteemed Legend

You can only do this if the city field exists as an indexed field, which almost certainly in your case, it does not. To test, try this search:

index=_* sourcetype=testlog city::*

If this returns no events the EITHER your sourcetype is not testlog (so your props.conf stanza header is wrong) OR city is not an indexed field. You can use something like this instead:

INGEST_EVAL = eval_city=lower(replace(replace(_raw, SuffixRegExHere), PrefixRegExHere, "")
0 Karma

skoelpin
SplunkTrust
SplunkTrust

What's your purpose of wanting to create an index time eval? There's more benefit of doing it at search time

0 Karma

agro1986001
Engager

@richgalloway

Thanks for your reply

$ pwd
/Applications/Splunk/etc/system/local

$ cat transforms.conf
[myeval]
INGEST_EVAL = eval_city=lower(city)

$ cat props.conf
[testLog]
TRANSFORMS = myeval

$ cat fields.conf
[eval_city]
INDEXED = True

Here's my search

sourcetype=testLog
time=2019-01-27T15:23:02.664129+09:00 eventName=purchase userId=8304 city="London" item=food price=4200

And here's trying to get the ingest-time eval field

sourcetype=testLog | table userId, city, eval_city

but eval_city is blank

Any idea? Thanks a lot!

0 Karma

jkat54
SplunkTrust
SplunkTrust

What version of Splunk are you using?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Have you also added to fields.conf?

[eval_city]
INDEXED = True
---
If this reply helps you, Karma would be appreciated.
0 Karma

richgalloway
SplunkTrust
SplunkTrust

What are your props.conf and transforms.conf settings? What is the full query you're using to find the field?

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Enhance Security Operations with Automated Threat Analysis in the Splunk EcosystemAre you leveraging ...

Splunk Developers: Go Beyond the Dashboard with These .Conf25 Sessions

  Whether you’re building custom apps, diving into SPL2, or integrating AI and machine learning into your ...

Index This | How do you write 23 only using the number 2?

July 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...