https://community.splunk.com/t5/Splunk-Search/fields-that-begin-with-a-number/m-p/34011#M178333 <P>props.conf</P> <PRE><CODE>[my_sourcetype] REPORT-cleanupkeys = clean_my_keys </CODE></PRE> <P>transforms.conf</P> <PRE><CODE>[clean_my_keys] REGEX = ^([^=]*)=([^\n]*) FORMAT = $1::$2 CLEAN_KEYS = false </CODE></PRE> Wed, 15 May 2013 19:42:08 GMT alexl1 2013-05-15T19:42:08Z https://community.splunk.com/t5/Splunk-Search/fields-that-begin-with-a-number/m-p/34008#M178330 <P>I have a bunch of fields that begin with a number, which Splunk doesn't allow, is there a way to put an alpha character in front in props.conf so they get indexed?</P> Wed, 15 May 2013 03:09:11 GMT https://community.splunk.com/t5/Splunk-Search/fields-that-begin-with-a-number/m-p/34008#M178330 alexl1 2013-05-15T03:09:11Z https://community.splunk.com/t5/Splunk-Search/fields-that-begin-with-a-number/m-p/34009#M178331 <P>Hi, i think you can keep your fields with the starting with a number, if you use a REPORT transform for the extraction, and set <CODE>CLEAN_KEYS = false</CODE></P> <P><A href="http://docs.splunk.com/Documentation/Splunk/5.0.2/Knowledge/Createandmaintainsearch-timefieldextractionsthroughconfigurationfiles#Use_proper_field_name_syntax">http://docs.splunk.com/Documentation/Splunk/5.0.2/Knowledge/Createandmaintainsearch-timefieldextractionsthroughconfigurationfiles#Use_proper_field_name_syntax</A><BR /> <A href="http://docs.splunk.com/Documentation/Splunk/5.0.2/Knowledge/Createandmaintainsearch-timefieldextractionsthroughconfigurationfiles#Create_advanced_search-time_field_extractions_with_field_transforms">http://docs.splunk.com/Documentation/Splunk/5.0.2/Knowledge/Createandmaintainsearch-timefieldextractionsthroughconfigurationfiles#Create_advanced_search-time_field_extractions_with_field_transforms</A></P> <P>/K</P> Wed, 15 May 2013 08:33:35 GMT https://community.splunk.com/t5/Splunk-Search/fields-that-begin-with-a-number/m-p/34009#M178331 kristian_kolb 2013-05-15T08:33:35Z https://community.splunk.com/t5/Splunk-Search/fields-that-begin-with-a-number/m-p/34010#M178332 <P>is there a way to do it at the indexing layer?</P> Wed, 15 May 2013 14:48:05 GMT https://community.splunk.com/t5/Splunk-Search/fields-that-begin-with-a-number/m-p/34010#M178332 alexl1 2013-05-15T14:48:05Z https://community.splunk.com/t5/Splunk-Search/fields-that-begin-with-a-number/m-p/34011#M178333 <P>props.conf</P> <PRE><CODE>[my_sourcetype] REPORT-cleanupkeys = clean_my_keys </CODE></PRE> <P>transforms.conf</P> <PRE><CODE>[clean_my_keys] REGEX = ^([^=]*)=([^\n]*) FORMAT = $1::$2 CLEAN_KEYS = false </CODE></PRE> Wed, 15 May 2013 19:42:08 GMT https://community.splunk.com/t5/Splunk-Search/fields-that-begin-with-a-number/m-p/34011#M178333 alexl1 2013-05-15T19:42:08Z