I have done testing the calculated fields for Splunk DB Connect in my local machine. Basically I added props.conf file to the following folder: %SPLUNK_HOM%etcappsdbxlocal
In the file, I have something like this
[MySoureType]
EVAL-cpu_time_s = CPU / 1000
EVAL-duration_s = Duration / (1000 * 1000)
It works perfectly in my local environment, I can see those fields (cpu_time_s, duration_s) show up in the search. However, when I implement in the actual server (a dedicated heavy forwarder installed with Dbx in a distributed environment), I can't find those fields anymore.
Any reason why it behaves differently? How should I troubleshoot this situation. Thanks!