Getting Data In

Lookup fields: How to re-evaluate or re-alias in props?

koshyk
Super Champion

As per props.conf spec

Splunk processes lookups after it processes field extractions, field   aliases, and calculated fields (EVAL-* statements). This means that you   can use extracted fields, aliased fields, and calculated fields to specify   lookups. But you can't use fields discovered by lookups in the configurations of extracted fields, aliased fields, or calculated fields.

Currently our TA have got LOOKUP in props.conf . But there are so much enriched information after the LOOKUP which is further required for EVAL/FIELDALIAS to create a model. How to make use of these "calculated" fields again in props.conf?

Is there any trick/tips to override the above restriction? i.e. use the discovered fields from lookup to be Aliased to a CIM field in props.conf?

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi koshyk,
if you don't want to redefine every time calculated fields from lookup fields, you could create one or more macros to do this and recoll them when you need calculated fields.
I used this method.
Bye.
Giuseppe

0 Karma

koshyk
Super Champion

thanks mate. but how can you do that in props.conf?

0 Karma

gcusello
SplunkTrust
SplunkTrust
0 Karma

somesoni2
SplunkTrust
SplunkTrust

What is your exact requirement? Do you want to rename a field coming from lookup to something already existing?

0 Karma

koshyk
Super Champion

The exact requirement is:
Currently our TA have got LOOKUP in props.conf . But there are so much enriched information after the LOOKUP which is further required for EVAL/FIELDALIAS to create a model. How to make use of these "calculated" fields again in props.conf?

(I've updated the requirement to the question as well)

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...