PROPS Configuration with CSV Header- Requesting feedback and if there is a way to change field name

SplunkDash — Thu, 03 Mar 2022 18:56:54 GMT

Hello,

I have CSV (with epoch time) source files (file with a few sample events given below) with header info. I wrote a props configuration file (see below). I tested this props with a few events and working as expected. Do you have any recommendation on this props configuration file or I am good to go with this props.conf? Also is there any way I can change the field name (i.e., id as ID, created as TIMESTAMP.........so on)? Your feedback and help will be highly appreciated. Thank you so much.

Sample csv with epoch time:

props.conf that I Wrote:prop

[ csv ]

SHOULD_LINEMERGE=false

CHARSET=UTF-8

INDEXED_EXTRACTIONS=csv

category=Structured

HEADER_FIELD_LINE_NUMBER=1

TIMESTAMP_FIELDS=created

TIME_FORMAT=%s%9N

MAX_TIMESTAMP_LOOKAHEAD=14

Re: PROPS Configuration with CSV Header

richgalloway — Thu, 03 Mar 2022 18:49:15 GMT

The existing props look good to me.

I don't know that you can rename fields, but you can create new fields using the EVAL or FIELDALIAS properties.

EVAL-ID = id FIELDALIAS-someuniquename = created as TIMESTAMP

topic PROPS Configuration with CSV Header- Requesting feedback and if there is a way to change field name in Splunk Search

PROPS Configuration with CSV Header- Requesting feedback and if there is a way to change field name

Re: PROPS Configuration with CSV Header