Getting Data In

Import CSV with column that has "Change %" (percent symbol) in it. How do I search on this field?

Communicator

Hello,

I have been importing a CSV that has a column that has a percent symbol in it.

How do I search on this particular field?

The name of the column in the CSV is: "Change %".

Thanks!

0 Karma
1 Solution

Champion

Can not find it with this(Change+space)?

(your search)|table "Change "

View solution in original post

0 Karma

@agoktas I can recommend @niketnilay's answer if you continue using the "Change %" format. At the company I work at it has been best practice to use underscores "_" as the replacement for spaces in field names. This will simplify searches down the line because you will not have to place quotes before and after your field names. Alternatively, another method we use for naming fields is to name them without spaces or underscores and to simply capitalize the first letter of each word in the field name. For instance your field name could be "MyNewFieldName". Lastly, while I do not think it is a matter of "best practice", I would personally shy away from using symbols in your field names and spell out the symbol's name for instance "Change_Percent". These would be my suggestions on how to solve your bumps in the road, but either way @niketnilay's answer works well if you want to stay with your current field naming format.

Suggested Alternatives:
Underscores: "Change_%"
No spaces: "Change%"
Only plain text: "ChangePercent"/"Change_Percent"

Have a great day!

0 Karma

SplunkTrust
SplunkTrust

@agoktas, if your lookup file name is my_lookup_file.csv then try the following command to ensure that the change % field is displayed

| inputlookup my_lookup_file.csv

If you are able to see Change % column you can filter by its column name in double quotes

| inputlookup my_lookup_file.csv where "Change %"=30

Or

| inputlookup my_lookup_file.csv 
| search "Change %"=30

For displaying as table

| inputlookup my_lookup_file.csv 
| table "Change %"
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

Champion

Can not find it with this(Change+space)?

(your search)|table "Change "

View solution in original post

0 Karma

Communicator

Boom! It was the space that was added because of the "%".

Thanks bud!

0 Karma

Communicator

can you please share what command are you trying to run to query the csv.

0 Karma