Knowledge Management

Can I use a IF\ElSE in a props.conf?

pfabrizi
Path Finder

Can I use IF\ELSE in a PROPS.conf? What does the syntax look like.

basically we want to do a if this eventid then do this else do this.

can I nest them.

Tags (1)
0 Karma
1 Solution

mayurr98
Super Champion

hey yes you can do!!

Calculated fields with props.conf example

This example examines earthquake data and classifies quakes by their depth by creating a Description field:

source=eqs7day-M1.csv | eval Description=case(Depth<=70, "Shallow", Depth>70 AND Depth<=300, "Mid", Depth>300 AND Depth<=700, "Deep") | table Datetime, Region, Depth, Description

Steps
Using calculated fields, you could define the eval expression for the Description field in props.conf.

  1. Create the following stanza in props.conf.

    <Stanza>
    Eval-Description = case(Depth<=70, "Shallow", Depth>70 AND Depth<=300, "Mid", Depth>300 AND Depth<=700, "Deep")

2 . Rewrite the search as:

source=eqs7day-M1.csv | table Datetime, Region, Depth, Description

You can now search on Description as if it is any other extracted field. Splunk software will find the calculated field key and evaluate it for every event that contains a Depth field. You can also run searches like this:

source=eqs7day-M1.csv Description=Deep

Refer this link for more it is the same
https://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Configurecalculatedfieldswithprops.con...

let me know if this helps!

View solution in original post

0 Karma

mayurr98
Super Champion

hey yes you can do!!

Calculated fields with props.conf example

This example examines earthquake data and classifies quakes by their depth by creating a Description field:

source=eqs7day-M1.csv | eval Description=case(Depth<=70, "Shallow", Depth>70 AND Depth<=300, "Mid", Depth>300 AND Depth<=700, "Deep") | table Datetime, Region, Depth, Description

Steps
Using calculated fields, you could define the eval expression for the Description field in props.conf.

  1. Create the following stanza in props.conf.

    <Stanza>
    Eval-Description = case(Depth<=70, "Shallow", Depth>70 AND Depth<=300, "Mid", Depth>300 AND Depth<=700, "Deep")

2 . Rewrite the search as:

source=eqs7day-M1.csv | table Datetime, Region, Depth, Description

You can now search on Description as if it is any other extracted field. Splunk software will find the calculated field key and evaluate it for every event that contains a Depth field. You can also run searches like this:

source=eqs7day-M1.csv Description=Deep

Refer this link for more it is the same
https://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Configurecalculatedfieldswithprops.con...

let me know if this helps!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...