How to edit automatic field extractions

clintla — Mon, 12 Jul 2021 16:50:44 GMT

I have some automatic field extractions specified in Props.conf per below

INDEXED_EXTRACTIONS=CSV
HEADER_FIELD_LINE_NUMBER=1

They work great and they are extracting about 30 columns but about 5 have 2 words

& I have to specify in each search to rename using one word.

I dont really see any config place to just remove the space in the automatic extraction.
Is there anyway to just make this change to these few extraction names in any config files?

Re: How to edit automatic field extractions

venkatasri — Tue, 13 Jul 2021 02:02:54 GMT

Hi @clintla

If you haven't set the following key meaning default behaviour takes care of words, then words with spaces would replaced with _. For example "customer name" would be seen as "customer_name" in search results.

HEADER_FIELD_ACCEPTABLE_SPECIAL_CHARACTERS = <string> * This setting specifies the special characters that are allowed in header fields. * When this setting is not set, the processor replaces all characters in header field names that are neither alphanumeric or a space (" ") with underscores. * For example, if you import a CSV file, and one of the header field names is "field.name", the processor replaces "field.name" with "field_name", and imports the field this way.

Is that something you are looking for?

topic How to edit automatic field extractions in Splunk Search

How to edit automatic field extractions

Re: How to edit automatic field extractions