Getting Data In

Why do I have fieldnames in my TSV data

tkwaller_2
Communicator

Hello

I have configured a monitor for our TSV data but I am getting field names in the data. I believe its because I'm using the "FIELD_NAMES" in my props.conf OR its since these are in the file header but Im not exactly sure.

heres my props.conf on my UF

[fp:tsv]
FIELD_DELIMITER = \t
HEADER_FIELD_DELIMITER = \t
INDEXED_EXTRACTIONS = TSV
FIELD_NAMES = <around 100 field names>

My props.conf on indexers:

[fp:tsv]
FIELD_DELIMITER = \t
HEADER_FIELD_DELIMITER = \t
FIELD_NAMES = <around 100 field names>
KV_MODE = none

For example
Field name:
data_authentication

Values:
5.0

7.5
data.score_adjusted

If you click on the value data.score_adjusted in the fields list under the data_authentication it returns the FIELD_NAMES event record.
So I guess my question is 2 part:
1. Is the reason for this because I am using the FIELD_NAMES config in props?
2. Can I fix this by removing that and reindexing? Any other issues that you might see with this?

Thanks for the thoughts
Todd

0 Karma
1 Solution

tkwaller_2
Communicator

Answered my own question in testing. Found that removing the FIELD_NAMES part of the stanza did indeed keep field names out of the fields, it seems that in instances where the field was null it populated with field names.

Side Note:
I also fixed timestampping:

[fp:tsv]
FIELD_DELIMITER = \t
HEADER_FIELD_DELIMITER = \t
INDEXED_EXTRACTIONS = TSV
TIMESTAMP_FIELDS = md_createdAt

View solution in original post

0 Karma

tkwaller_2
Communicator

Answered my own question in testing. Found that removing the FIELD_NAMES part of the stanza did indeed keep field names out of the fields, it seems that in instances where the field was null it populated with field names.

Side Note:
I also fixed timestampping:

[fp:tsv]
FIELD_DELIMITER = \t
HEADER_FIELD_DELIMITER = \t
INDEXED_EXTRACTIONS = TSV
TIMESTAMP_FIELDS = md_createdAt

View solution in original post

0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!