Splunk Search

CASE command in Props.conf

pavanbmishra
Path Finder

Hello SMEs....Seeking helping hand

I got stuck while putting EVAL-<field-name> in props.conf using case command and it is not at all working while the same is working in search bar in GUI. As suggestion would be highly appreciated

 

EVAL-XYZ = case(src== "AAA", field1, src== "BBB", field2 , src== "CCC", field3)

Labels (1)
Tags (1)
0 Karma
1 Solution

s2_splunk
Splunk Employee
Splunk Employee

I would suggest to add a default option at the end to see whether this eval just doesn't match any of your options (or your sourcetype?) and go from there. Generally, it looks correct. Case-sensitivity for field names is my only idea. Try this and see if you at least get your field with the default value: 

 

EVAL-XYZ = case(src="AAA", field1, src="BBB", field2 , src="CCC", field3, 1=1, "HITTING DEFAULT IN EVAL")

 

 If this doesn't help and you can, please post your exact props.conf file

View solution in original post

s2_splunk
Splunk Employee
Splunk Employee

I would suggest to add a default option at the end to see whether this eval just doesn't match any of your options (or your sourcetype?) and go from there. Generally, it looks correct. Case-sensitivity for field names is my only idea. Try this and see if you at least get your field with the default value: 

 

EVAL-XYZ = case(src="AAA", field1, src="BBB", field2 , src="CCC", field3, 1=1, "HITTING DEFAULT IN EVAL")

 

 If this doesn't help and you can, please post your exact props.conf file

Vardhan
Contributor

HI @pavanbmishra,

The eval -xyz filed name have you used anywhere else in the same props. conf? And where exactly have you placed the props. conf? 

 

0 Karma

pavanbmishra
Path Finder

Thanks Vardhan for your quick help 🙂

No i am not using that eval-xyz field anywhere in the props.conf, i put my config file under below folder

/etc/apps/<app-name>/local folder 

0 Karma

Vardhan
Contributor

Hi @pavanbmishra,

 

Did you verify the local.meta of your apps folder? And also the after placing the props.conf in search head can you quickly restart and check if it is a single instance. For distributed search head cluster no restart required.

The only eval is not working all other fields are working fine?

0 Karma

pavanbmishra
Path Finder

Yeah all filed working except that eval expression. What should i check under local.meta ?

BTW it is single instance and i restarted that also. Thanks 🙂

0 Karma

Vardhan
Contributor

Hi @pavanbmishra ,

Can you try with the below eval and see the result.

EVAL-XYZ = case(src== "AAA", "field1", src== "BBB", "field2" , src== "CCC", "field3")

And also make sure you are able to see the mentioned src fields values in the case.

0 Karma
Get Updates on the Splunk Community!

BSides Splunk 2022 - The Call for Papers is now Open!

TLDR; Main Site: https://bsidessplunk.com CFP Site: https://bsidessplunk.com/cfp CFP Opens: December 15th, ...

Sending Metrics to Splunk Enterprise With the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

What's New in Splunk Cloud Platform 9.0.2208?!

Howdy!  We are happy to share the newest updates in Splunk Cloud Platform 9.0.2208! Analysts can benefit ...