Getting Data In

Why do I have fieldnames in my TSV data

tkwaller_2
Communicator

Hello

I have configured a monitor for our TSV data but I am getting field names in the data. I believe its because I'm using the "FIELD_NAMES" in my props.conf OR its since these are in the file header but Im not exactly sure.

heres my props.conf on my UF

[fp:tsv]
FIELD_DELIMITER = \t
HEADER_FIELD_DELIMITER = \t
INDEXED_EXTRACTIONS = TSV
FIELD_NAMES = <around 100 field names>

My props.conf on indexers:

[fp:tsv]
FIELD_DELIMITER = \t
HEADER_FIELD_DELIMITER = \t
FIELD_NAMES = <around 100 field names>
KV_MODE = none

For example
Field name:
data_authentication

Values:
5.0

7.5
data.score_adjusted

If you click on the value data.score_adjusted in the fields list under the data_authentication it returns the FIELD_NAMES event record.
So I guess my question is 2 part:
1. Is the reason for this because I am using the FIELD_NAMES config in props?
2. Can I fix this by removing that and reindexing? Any other issues that you might see with this?

Thanks for the thoughts
Todd

0 Karma
1 Solution

tkwaller_2
Communicator

Answered my own question in testing. Found that removing the FIELD_NAMES part of the stanza did indeed keep field names out of the fields, it seems that in instances where the field was null it populated with field names.

Side Note:
I also fixed timestampping:

[fp:tsv]
FIELD_DELIMITER = \t
HEADER_FIELD_DELIMITER = \t
INDEXED_EXTRACTIONS = TSV
TIMESTAMP_FIELDS = md_createdAt

View solution in original post

0 Karma

tkwaller_2
Communicator

Answered my own question in testing. Found that removing the FIELD_NAMES part of the stanza did indeed keep field names out of the fields, it seems that in instances where the field was null it populated with field names.

Side Note:
I also fixed timestampping:

[fp:tsv]
FIELD_DELIMITER = \t
HEADER_FIELD_DELIMITER = \t
INDEXED_EXTRACTIONS = TSV
TIMESTAMP_FIELDS = md_createdAt
0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...