Is there a way to rename CSV column headers prior to indexing the data?

[jwhughes58]

I've got a data source with a header like this

IP Address,Internal Domain,External Domain,Internal Dns,External Dns,Known,Target,Open Ports,Closed Ports,Mixed Ports,Error Ports,Confidence,Match Type,Expression,Match,Value,Confidence,Match Type,Expression,Match,Value,Confidence,Match Type,Expression,Match,Value,Confidence,Match Type,Expression,Match,Value,Confidence,Match Type,Expression,Match,Value,Routing Device,Stealth,Switching Device,Sensor,Host,Asname,Netblock,Dns Resolver,Name,Id,Managed Router,Forwarder,Unauthorized Perimeter,Has Traces,Has Responses,Filtering Icmp,Broadcaster,In Snmp Discovered Cidr,In Snmp Responder,In Target Cidr,In Known Cidr,Leaking Inbound,Leaking Outbound,Perimeter Node,Leaking Routing Device,Ipv6 Enabled,Is Snmp Accessible,Filtering Device,Filtering Path,Bgp Router,Snmp Interface,Ld Router

Note there are five times that Confidence shows up in the header. Other than editing the header before ingesting it into Splunk, is there a way in Splunk of renaming the header columns prior to ingesting the data? What happens now is if there are 4 values for Confidence then when viewed in the UI the data looks like this

Confidence
Value 1
Value 2
Value 3
Value 4

This makes it hard to know what the Confidence is associated with.

TIA

[sundareshr · Accepted solution]

Look at this section in the online documentation here http://docs.splunk.com/Documentation/Splunk/6.4.2/Admin/Transformsconf

[extract_csv]
DELIMS = ","
FIELDS = "field1", "field2", "field3"

[jwhughes58]

Thanks. I see I was looking at the data the wrong way. Instead of renaming the columns of the header, just read in the data and have the [extract_csv] stanza put the data into the field names I create.