Getting Data In

How to remove spaces from CSV column names to get data into a pivot table?

cdstealer
Contributor

Hi,

I'm trying to ingest some CSV files that contain QOS metrics. The issue I have is that I need to get this data into a pivot table which stops and complains of the spaces. Now when I add the extracted attributes, I do have the options to rename each field name. Not an ideal solution if the CSV contains 100+ columns 😞

I've tried defining the SEDCMD "SEDCMD = 's/ //g'" command in props.conf but this had no effect. Has anyone come across this and auto removed the spaces?

eg:
CLASS_MRR_Backup - Throughput (I/O/sec)

So when "Add Auto-Extracted Field", I get the error "Field Name can not contain whitespace, double quotes, single quotes, curly braces or asterisks." even if I use the rename option.

Cheers
Steve

Tags (4)
0 Karma

sundareshr
Legend

sedcmd will not work with Indexed Extractions. Remove the indexed extraction=csv from your props and extract using DELIMs. You will now be able to use SEDCMD to replace spaces with underscore (or whatever)

gpareesi11
Path Finder

I have exactly the same issue, I working to fix it, but if you have found a solution please post the answer.

Thanks

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Unlocking Unified Insights: New Gigamon Federated Search App for Splunk

In today’s data-heavy environment, organizations are caught in a data distribution dilemma. As data volumes ...

GA: New Data Management App in Splunk Platform

Streamlining Data Management: Introducing a unified experience in Splunk Managing data at scale shouldn’t feel ...

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...