All Apps and Add-ons

How to change column header using lookup file editor?

plaxosi
Explorer

How can I change the column name of a CSV using Lookup File Editor (v3.2.1) on a Splunk (v7.2.4) searchhead cluster. If my memory does not deceive me this was possible using Lookup Editor v2.7.1 by simply double clicking on the column header. With the latest version clicking on the header has the effect of reversing the sort order.

Thanks.

Tags (2)
0 Karma
1 Solution

nickhills
Ultra Champion

Right click on the col name, and click edit.

The new version seems a bit tricky - you have to be precise with the click.

If my comment helps, please give it a thumbs up!

View solution in original post

0 Karma

nickhills
Ultra Champion

Right click on the col name, and click edit.

The new version seems a bit tricky - you have to be precise with the click.

If my comment helps, please give it a thumbs up!
0 Karma

plaxosi
Explorer

Hi nickhillscpl
Thanks for the suggestion. You are right, it is tricky. I was only getting the correct edit box about once every twenty attempts, most of the time I ended up editing the first data cell. What seems to work for most of the time me is right click on the column header and then right click (but not left click) on the "edit" option.

0 Karma

jmeager_splunk
Splunk Employee
Splunk Employee

I third this. Right click on edit is the trick.

0 Karma

astatrial
Contributor

@plaxosi
Right click on the edit works like a charm, it really got my nerves. Thanks

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...