Splunk Search

split function in calculated fields

AlexeyNL
Explorer

When i try to save in Splunk Web calculated fields that contains split function i have a "Encountered the following error while trying to save: In handler 'props-eval': Bad function" message.
Why i can't use this function in calculated fields?
There is no word about this limitation here in Splunk Documentation,
Examples of Eval expression that are not working:

split(anyfield,";")

or

split("x:x",":")

But in conjunction with eval in Search these are working fine.

Splunk Version............................................6.0
Splunk Build............................................182037

Tags (3)

joebensimo
Path Finder

This appears to only be a limitation in the user interface. I have successfully added (and use) calculated fields that use split by directly adding them to a props.conf file.

For example:

[source::users*ly]
EVAL-userid = split(userid," ")

joebensimo
Path Finder

I too am having this problem when I use split is calculated fields. Eg: split(field," ")

0 Karma

mklunder
Explorer

I have also encountered the same issue. In my case I am adding the eval below in the web UI (6.0).

Expression:
mvcount( SPLIT(nodes, ",") )

Returns:
Encountered the following error while trying to save: In handler 'props-eval': Bad function

alacercogitatus
SplunkTrust
SplunkTrust

Can you edit and put your calculated input definition?

0 Karma
Get Updates on the Splunk Community!

The OpenTelemetry Certified Associate (OTCA) Exam

What’s this OTCA exam? The Linux Foundation offers the OpenTelemetry Certified Associate (OTCA) credential to ...

From Manual to Agentic: Level Up Your SOC at Cisco Live

Welcome to the Era of the Agentic SOC   Are you tired of being a manual alert responder? The security ...

Splunk Classroom Chronicles: Training Tales and Testimonials (Episode 4)

Welcome back to Splunk Classroom Chronicles, our ongoing series where we shine a light on what really happens ...