I am trying to use a filed in calculated fields from props.conf to replace space in one of my field values but not getting any results in Splunk 6.2.
Below is EVAL stanza from props.conf -
EVAL-Customer_Id_New=replace(Customer_Id," ","")
Not getting any new field "Customer_Id_New" in interesting field for that sourcetype. Please help me if you can.
Thanks in advance
↧