Getting Data In

Why are mvindex and mvjoin not working while using eval to define calculated fields in props.conf?

tsawant
New Member

Here's a quick question I am trying to implement calculated fields in props.conf using EVAL command following is the code that I am trying to implement:

EVAL-PAYXLINE_MV2=mvindex(PAYXLINE_MV,N,-1) 
EVAL-PAYXLINEGLOB=mvjoin(PAYXLINE_MV2," ")
EVAL-PAYXHASH=sha256(mvjoin(PAYXLINE_MV," "))

The problem is I am not able to get the first 2 commands working when I put mvindex and mvjoin directly but it works perfectly fine when I use mvjoin with sha256. Can you help me to solve this problem. Here is the documentation that I am following to define fields in props.conf.
http://docs.splunk.com/Documentation/Splunk/6.2.1/Knowledge/definecalcfields

0 Karma

wpreston
Motivator

Can you share your props.conf and transforms.conf lines for the PAYXLINE_MV field?

0 Karma

_d_
Splunk Employee
Splunk Employee

Well, in your first two statements you're evaluating PAYXLINE_MV2 on the first and then calling it again on the second. Calculated fields are evaluated in parallel and not in sequence; i.e. PAYXLINE_MV2 is not availalbe to the 2nd statement when it tries to execute. Try something like this:

EVAL-PAYXLINEGLOB=mvjoin(mvindex(PAYXLINE_MV,N,-1)," ")

n00b
Explorer

This comment about it happening in parallel vs in order fixed an issue I had for days!

0 Karma

tsawant
New Member

Not working I tried doing that previously.

0 Karma

_d_
Splunk Employee
Splunk Employee

That should work if 'PAYXLINE_MV' is indeed a multivalued field and 'N' is a number.

0 Karma

tsawant
New Member

yea its a multivalued field and N is number

0 Karma

_d_
Splunk Employee
Splunk Employee

In addition to being a number, N needs to be within the range of the length of the multivalued field.

0 Karma

tsawant
New Member

mvjoin works perfectly in props.conf right ?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...