I created a datamodel from a source, which had spaces in the field names, but field were automatically created with the same names, just omitting the spaces. Both were shown when at the Add Auto-Extracted Field window, like this:
"Field Name" (original)
"FieldName" (automatically created)
I moved my app to another search head, but I can't create the same datamodel, because of the spaces ...
I get the " Field Name can not contain whitespace, double quotes, single quotes, curly braces or asterisks. " error message.
How to fix this ?
The issue was on my side...I forgot that in my props.conf I've explicitly defined the header to use, that's why I had field names without spaces.
The issue was on my side...I forgot that in my props.conf I've explicitly defined the header to use, that's why I had field names without spaces.
Anyone could find a solution to this