I've extracted a field called QR from a sourcetype, and it's working perfectly, but is returning numerical data, and I need specific words for a Enterprise Security dashboard to work. When I type the following eval command into the search bar it works perfectly, but when I place it in props.conf it doesn't execute correctly (new field is not created):
sourcetype = MSAD:NT6:DNS | eval message_type = if(QR==0, "RESPONSE", "QUERY")
I'm wondering if I'm running into an order of precedence issue, where my EVAL is kicking off before a QR field is even created.
I have the following in my transforms and props files.
transforms.conf
[MSAD:NT6:DNS]
[dns_qr_extraction]
REGEX = (QR)\s+(\d)
FORMAT = $1::$2
props.conf
[MSAD:NT6:DNS]
REPORT-dns_qr_extraction = dns_qr_extraction
EVAL message_type = if(QR==0, "RESPONSE", QR==1, "QUERY", "UNKNOWN")
... View more