We have created a data model with root object. In our data, we have the fields in our CSV which have "space" in the headers like "FY16 data", "FY17 data" and so on.. now what we have done is we have created the alias for these fields and named it as "FY16_data", "FY17_data". Now when we are doing the auto extraction for the attributes in the root object, it is showing both the fieldnames with "space" as well as
_. I don't want to show the fieldnames with "space" when I do "Add Auto-Extracted Field" . Is there a way to disable or hide the old fieldnames that have "space" in their header ?
Yes I know that unless I select the field it will not show. But still I want that those old fields shud not show up in the auto extract list also ? Can it be done ? Is it possible to use fields.conf for that ? Pls advise.
That loos like it is an extracted field or Aliased field. Have you looked to see if you have any field extractions or aliases setup for "Approval Date"? You should be able to modify or delete those if you do
where should I add the above command "| fields - "* *", as I told you I am not using any splunk query here. Hope you are getting my question ? Can you let me know how can i use it in the datamodel root event object ?