Getting Data In

Why are mvindex and mvjoin not working while using eval to define calculated fields in props.conf?

tsawant
New Member

Here's a quick question I am trying to implement calculated fields in props.conf using EVAL command following is the code that I am trying to implement:

EVAL-PAYXLINE_MV2=mvindex(PAYXLINE_MV,N,-1) 
EVAL-PAYXLINEGLOB=mvjoin(PAYXLINE_MV2," ")
EVAL-PAYXHASH=sha256(mvjoin(PAYXLINE_MV," "))

The problem is I am not able to get the first 2 commands working when I put mvindex and mvjoin directly but it works perfectly fine when I use mvjoin with sha256. Can you help me to solve this problem. Here is the documentation that I am following to define fields in props.conf.
http://docs.splunk.com/Documentation/Splunk/6.2.1/Knowledge/definecalcfields

0 Karma

wpreston
Motivator

Can you share your props.conf and transforms.conf lines for the PAYXLINE_MV field?

0 Karma

_d_
Splunk Employee
Splunk Employee

Well, in your first two statements you're evaluating PAYXLINE_MV2 on the first and then calling it again on the second. Calculated fields are evaluated in parallel and not in sequence; i.e. PAYXLINE_MV2 is not availalbe to the 2nd statement when it tries to execute. Try something like this:

EVAL-PAYXLINEGLOB=mvjoin(mvindex(PAYXLINE_MV,N,-1)," ")

0 Karma

tsawant
New Member

Not working I tried doing that previously.

0 Karma

_d_
Splunk Employee
Splunk Employee

That should work if 'PAYXLINE_MV' is indeed a multivalued field and 'N' is a number.

0 Karma

tsawant
New Member

yea its a multivalued field and N is number

0 Karma

_d_
Splunk Employee
Splunk Employee

In addition to being a number, N needs to be within the range of the length of the multivalued field.

0 Karma

tsawant
New Member

mvjoin works perfectly in props.conf right ?

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!