How to handle a csv with field name only consist of numbers

[dennisj]

Hi All,

I have a csv looks like below

Name, Description, 1960,1961,1962,1963,1964,....,2013
test, testdescription, 5.3, 5.6, 5.8,5.9,6.2, 6.4, ....., 4.5
test2, testdesc2, 11.3, 11.9, 12.7, 15.8, 19.2, ....., 20.1

When I import to splunk, the field "Name", "Description" extract very well, however, all the field name with only numbers didn't extract.

How to handle such a case?

[kristian_kolb · Accepted solution]

The reason for your fields not appearing is that Splunk only allows field names to contain a-z, A-Z, 0-9 and _. Any non-allowed characters in field names are converted to . And field names cannot begin with 0-9 or ``. Thus a purely numerical field name would be converted to just underscores, which are not allowed.

http://docs.splunk.com/Documentation/Splunk/5.0.2/Knowledge/Createandmaintainsearch-timefieldextract...

You can create fields that have numerical names through a REPORT field transform where you set CLEAN_KEYS = false. (see first link below), but that may not really be what you want, since you might have a hard time to use the fields in certain operations (see second link below).

You might be better off if you could change the CSV headers to start with a letter, e.g. y1960, y1961, y1962 ... y2013.

http://docs.splunk.com/Documentation/Splunk/5.0.2/Knowledge/Createandmaintainsearch-timefieldextract...

http://answers.splunk.com/answers/11014/eval-on-numerically-named-fields

Hope this helps,

K

[HiroshiSatoh]

By not but change the field name because it is with [Field names cannot begin with 0-9]?