Getting Data In

How to remove spaces from CSV column names to get data into a pivot table?

cdstealer
Contributor

Hi,

I'm trying to ingest some CSV files that contain QOS metrics. The issue I have is that I need to get this data into a pivot table which stops and complains of the spaces. Now when I add the extracted attributes, I do have the options to rename each field name. Not an ideal solution if the CSV contains 100+ columns 😞

I've tried defining the SEDCMD "SEDCMD = 's/ //g'" command in props.conf but this had no effect. Has anyone come across this and auto removed the spaces?

eg:
CLASS_MRR_Backup - Throughput (I/O/sec)

So when "Add Auto-Extracted Field", I get the error "Field Name can not contain whitespace, double quotes, single quotes, curly braces or asterisks." even if I use the rename option.

Cheers
Steve

Tags (4)
0 Karma

sundareshr
Legend

sedcmd will not work with Indexed Extractions. Remove the indexed extraction=csv from your props and extract using DELIMs. You will now be able to use SEDCMD to replace spaces with underscore (or whatever)

gpareesi11
Path Finder

I have exactly the same issue, I working to fix it, but if you have found a solution please post the answer.

Thanks

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...