https://community.splunk.com/t5/Getting-Data-In/Selectively-ignoring-fields-in-CSV-input/m-p/38300#M7032 <P>Hey everyone. I am trying to input .csv files. The issue with the files is that the software generating them includes the timestamp numerous times in each line. Here's a rough example:</P> <PRE><CODE>timestamp,CPU Usage, timestamp, Memory usage, timestamp, temperature, timestamp, license usage, timestamp, SNMP reachability </CODE></PRE> <P>You get the idea. I don't want to waste space indexing all of the extra timestamp fields. Any advice?</P> Fri, 04 Feb 2011 01:25:28 GMT msarro 2011-02-04T01:25:28Z https://community.splunk.com/t5/Getting-Data-In/Selectively-ignoring-fields-in-CSV-input/m-p/38300#M7032 <P>Hey everyone. I am trying to input .csv files. The issue with the files is that the software generating them includes the timestamp numerous times in each line. Here's a rough example:</P> <PRE><CODE>timestamp,CPU Usage, timestamp, Memory usage, timestamp, temperature, timestamp, license usage, timestamp, SNMP reachability </CODE></PRE> <P>You get the idea. I don't want to waste space indexing all of the extra timestamp fields. Any advice?</P> Fri, 04 Feb 2011 01:25:28 GMT https://community.splunk.com/t5/Getting-Data-In/Selectively-ignoring-fields-in-CSV-input/m-p/38300#M7032 msarro 2011-02-04T01:25:28Z https://community.splunk.com/t5/Getting-Data-In/Selectively-ignoring-fields-in-CSV-input/m-p/38301#M7033 <P>You can use an index time TRANSFORM, or more likely a SEDCMD to modify the data before it goes into the index: <A href="http://www.splunk.com/base/Documentation/4.1.6/Admin/Anonymizedatawithsed" rel="nofollow">http://www.splunk.com/base/Documentation/4.1.6/Admin/Anonymizedatawithsed</A></P> Fri, 04 Feb 2011 04:41:08 GMT https://community.splunk.com/t5/Getting-Data-In/Selectively-ignoring-fields-in-CSV-input/m-p/38301#M7033 gkanapathy 2011-02-04T04:41:08Z