Getting Data In

Import CSV with column that has "Change %" (percent symbol) in it. How do I search on this field?

agoktas
Communicator

Hello,

I have been importing a CSV that has a column that has a percent symbol in it.

How do I search on this particular field?

The name of the column in the CSV is: "Change %".

Thanks!

0 Karma
1 Solution

HiroshiSatoh
Champion

Can not find it with this(Change+space)?

(your search)|table "Change "

View solution in original post

0 Karma

MarkAllen3711
Engager

@agoktas I can recommend @niketn's answer if you continue using the "Change %" format. At the company I work at it has been best practice to use underscores "_" as the replacement for spaces in field names. This will simplify searches down the line because you will not have to place quotes before and after your field names. Alternatively, another method we use for naming fields is to name them without spaces or underscores and to simply capitalize the first letter of each word in the field name. For instance your field name could be "MyNewFieldName". Lastly, while I do not think it is a matter of "best practice", I would personally shy away from using symbols in your field names and spell out the symbol's name for instance "Change_Percent". These would be my suggestions on how to solve your bumps in the road, but either way @niketn's answer works well if you want to stay with your current field naming format.

Suggested Alternatives:
Underscores: "Change_%"
No spaces: "Change%"
Only plain text: "ChangePercent"/"Change_Percent"

Have a great day!

0 Karma

niketn
Legend

@agoktas, if your lookup file name is my_lookup_file.csv then try the following command to ensure that the change % field is displayed

| inputlookup my_lookup_file.csv

If you are able to see Change % column you can filter by its column name in double quotes

| inputlookup my_lookup_file.csv where "Change %"=30

Or

| inputlookup my_lookup_file.csv 
| search "Change %"=30

For displaying as table

| inputlookup my_lookup_file.csv 
| table "Change %"
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

HiroshiSatoh
Champion

Can not find it with this(Change+space)?

(your search)|table "Change "

0 Karma

agoktas
Communicator

Boom! It was the space that was added because of the "%".

Thanks bud!

0 Karma

kunalmao
Communicator

can you please share what command are you trying to run to query the csv.

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...