Getting Data In

Why do I have fieldnames in my TSV data

tkwaller_2
Communicator

Hello

I have configured a monitor for our TSV data but I am getting field names in the data. I believe its because I'm using the "FIELD_NAMES" in my props.conf OR its since these are in the file header but Im not exactly sure.

heres my props.conf on my UF

[fp:tsv]
FIELD_DELIMITER = \t
HEADER_FIELD_DELIMITER = \t
INDEXED_EXTRACTIONS = TSV
FIELD_NAMES = <around 100 field names>

My props.conf on indexers:

[fp:tsv]
FIELD_DELIMITER = \t
HEADER_FIELD_DELIMITER = \t
FIELD_NAMES = <around 100 field names>
KV_MODE = none

For example
Field name:
data_authentication

Values:
5.0

7.5
data.score_adjusted

If you click on the value data.score_adjusted in the fields list under the data_authentication it returns the FIELD_NAMES event record.
So I guess my question is 2 part:
1. Is the reason for this because I am using the FIELD_NAMES config in props?
2. Can I fix this by removing that and reindexing? Any other issues that you might see with this?

Thanks for the thoughts
Todd

0 Karma
1 Solution

tkwaller_2
Communicator

Answered my own question in testing. Found that removing the FIELD_NAMES part of the stanza did indeed keep field names out of the fields, it seems that in instances where the field was null it populated with field names.

Side Note:
I also fixed timestampping:

[fp:tsv]
FIELD_DELIMITER = \t
HEADER_FIELD_DELIMITER = \t
INDEXED_EXTRACTIONS = TSV
TIMESTAMP_FIELDS = md_createdAt

View solution in original post

0 Karma

tkwaller_2
Communicator

Answered my own question in testing. Found that removing the FIELD_NAMES part of the stanza did indeed keep field names out of the fields, it seems that in instances where the field was null it populated with field names.

Side Note:
I also fixed timestampping:

[fp:tsv]
FIELD_DELIMITER = \t
HEADER_FIELD_DELIMITER = \t
INDEXED_EXTRACTIONS = TSV
TIMESTAMP_FIELDS = md_createdAt
0 Karma
Get Updates on the Splunk Community!

SplunkTrust | Where Are They Now - Michael Uschmann

The Background Five years ago, Splunk published several videos showcasing members of the SplunkTrust to share ...

Admin Your Splunk Cloud, Your Way

Join us to maximize different techniques to best tune Splunk Cloud. In this Tech Enablement, you will get ...

Cloud Platform | Discontinuing support for TLS version 1.0 and 1.1

Overview Transport Layer Security (TLS) is a security communications protocol that lets two computers, ...