Importing CSV field into an existing index field

[sbgoldberg13]

I've recently installed an add on in my dev instance which created various fields, including user and NormalizedUser. I have a one-time csv file that has a list of users I need imported into one or both of those existing fields. Is this possible? It doesn't seem to do so and I prefer not to have to search against multiple fields (I'd like to do a query against the Add On's index for user or NormalizedUser to only retrieve the entire list of users or NormalizedUser's.)  Currently it seems to input the csv data into some other field name and I don't even know where it's grabbing that field name from.  The field header on the csv column is NormalizedUser

Any help appreciated

[codebuilder]

Once your data has been indexed in Splunk it cannot be modified. Your only option would be to delete the existing data and re-ingest using your update schema.

When ingesting CSV files the field names are assigned based on the first line of the file. Basically this should be the column header name as if you were viewing it in Excel. If that line doesn't exist, or isn't consistent you will get unpredictable results in your index.

If you know ahead of time the header won't exist you can assign the field names in your sourcetype in props.conf. But any changes to the sourcetype will only affect new data coming in. Once the data has been indexed it's permanent.