Getting Data In

Lookup fields: How to re-evaluate or re-alias in props?

koshyk
Super Champion

As per props.conf spec

Splunk processes lookups after it processes field extractions, field   aliases, and calculated fields (EVAL-* statements). This means that you   can use extracted fields, aliased fields, and calculated fields to specify   lookups. But you can't use fields discovered by lookups in the configurations of extracted fields, aliased fields, or calculated fields.

Currently our TA have got LOOKUP in props.conf . But there are so much enriched information after the LOOKUP which is further required for EVAL/FIELDALIAS to create a model. How to make use of these "calculated" fields again in props.conf?

Is there any trick/tips to override the above restriction? i.e. use the discovered fields from lookup to be Aliased to a CIM field in props.conf?

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi koshyk,
if you don't want to redefine every time calculated fields from lookup fields, you could create one or more macros to do this and recoll them when you need calculated fields.
I used this method.
Bye.
Giuseppe

0 Karma

koshyk
Super Champion

thanks mate. but how can you do that in props.conf?

0 Karma

gcusello
SplunkTrust
SplunkTrust
0 Karma

somesoni2
SplunkTrust
SplunkTrust

What is your exact requirement? Do you want to rename a field coming from lookup to something already existing?

0 Karma

koshyk
Super Champion

The exact requirement is:
Currently our TA have got LOOKUP in props.conf . But there are so much enriched information after the LOOKUP which is further required for EVAL/FIELDALIAS to create a model. How to make use of these "calculated" fields again in props.conf?

(I've updated the requirement to the question as well)

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...