Getting Data In

Changing CSV file header

jwhughes58
Contributor

I'm working with a csv file with this header

Filenm,EIN,Status,Business Function,Maintained By, Region,Manufacturer Name,Building Name,Service Area,Model Name,Model Number,Serial Number,AM Tag Number,Equipment Type,Equipment Type Description,Network Connection Type Wired,IP Address v4 Wired,Nuvolo Flag,MAC Address Wired,Equipment Status Detail,Network Connection Type Wireless,IP Address v4 Wireless,IP Address Type Wireless,IP Address Type Wired,MAC Address Wireless,Host Name,Fully Qualified Domain Name,OS Version,Asset Type,Contains ePHI,Application Software Name

What I would like to do is have Splunk transform to closer to Splunk field names.  Such as

filenm,ein,status,business_function,maintained_by,region,manufacturer_name,building_name,service_area,model_name,model_number,serial_number,am_tag_mumber,equipment_type,equipment_type_description,network_connection_type_wired,ip_addres_v4_Wired,nuvolo_flag,mac_address_wired,equipment_status_detail,network_connection_type_wireless,ip_Address_v4_wireless,ip_address_type_wireless,ip_ddress_type_wired,mac_address_wireless,host_name,fully_qualified_domain_name,os_version,asset_type,contains_ephi,application_software_name

The only thing I've been able to find is putting something in the TA transforms.conf like this

[edge_asset_header]
DELIMS = ","
FIELDS = "filenm","ein","status","business_function","maintained_by","region","manufacturer_name","building_name","service_area","model_name","model_number","serial_number","am_tag_mumber","equipment_type","equipment_type_description","network_connection_type_wired","ip_addres_v4_Wired","nuvolo_flag","mac_address_wired","equipment_status_detail","network_connection_type_wireless","ip_Address_v4_wireless","ip_address_type_wireless","ip_ddress_type_wired","mac_address_wireless","host_name","fully_qualified_domain_name","os_version","asset_type","contains_ephi","application_software_name"

Is the only solution or did I miss something?

TIA,

Joe

Labels (3)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @jwhughes58,

you solution should work.

but anyway, there's also the approach that's used in normalization: create a set of aliases in yout App or TA, (not in a single search) that could be useful also wgen there are other fields named in those ways to rename.

I always normalize my field names in extraction for using also in other apps.

Ciao.

Giuseppe 

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi @jwhughes58,

you solution should work.

but anyway, there's also the approach that's used in normalization: create a set of aliases in yout App or TA, (not in a single search) that could be useful also wgen there are other fields named in those ways to rename.

I always normalize my field names in extraction for using also in other apps.

Ciao.

Giuseppe 

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...