Getting Data In

CSV file with column named "Index"

apnetmedic
Explorer

I've got a CSV file with a column called "Index." Naturally, this is a bit of a problem. Is there a way to deal with this other than making a new sourcetype for it and specifying the header row? I'd rather not do that because:

  • I actually have about 5 related CSV types with the same issue,
  • The exact column headers may change subtly between different software loads on the devices uploading them, and
  • I'm lazy, and this is something I'd only use occasionally. It might be easier for me to just hand-edit or sed the input files to rename the field.

I see a field called extracted_index when these files come in, and it appears to have the original value in it, but I can't seem to use it in a search or eval or stats command like I want to. What's up with that?

0 Karma
1 Solution

woodcock
Esteemed Legend

I am skeptical of your assertion at the end. You definitely should be able use extracted_index (or extracted_Index?) That's the whole reason that Splunk creates it!

View solution in original post

woodcock
Esteemed Legend

I am skeptical of your assertion at the end. You definitely should be able use extracted_index (or extracted_Index?) That's the whole reason that Splunk creates it!

apnetmedic
Explorer

Ah! Indeed. Victim of my own typo. I had "index" on the brain and thus typed it as such: extracted_index, lowercase. Original field was Index, so it's extracted_Index.

All is right with the world.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...