topic Re: SEDCMD to remove spaces in csv header fields in Splunk Search

SEDCMD to remove spaces in csv header fields

sbattista — Tue, 16 Nov 2021 19:14:19 GMT

what's the best way to set a sedcmd in props to remove spaces and add a " _ " in just the a cvs header line? for example-

I have a csv header like this;

field 1, field 2, filed 3

and I want the fields to be

field_1, field_2, filed_3

but just for the header, not for the data in the fields.

I see this in a old post but, it will change everything with a space even the data:

inputs.conf
[monitor://c:\temp\sed-csv.log]
disable=false
index=sedcsv
sourcetype=sedcsv

props.conf
[sedcsv]
SEDCMD-replacespace = s/ /_/g

https://community.splunk.com/t5/Splunk-Search/CSV-Field-Extraction-with-spaces-in-field-name/m-p/245974

FrankVl — Wed, 17 Nov 2021 15:46:28 GMT

Is the list of fields known and static? Then you can use the props.conf setting

FIELD_NAMES = field_1, field_2, field_3

to tell splunk what field names to use, rather than take them from the header row.

sbattista — Wed, 17 Nov 2021 15:59:09 GMT

sorry, I should have said this will be dynamic across about 50 or so different CSV's with different headers.