Splunk Search

Datamodel with spaces in field names?

szabados
Communicator

I created a datamodel from a source, which had spaces in the field names, but field were automatically created with the same names, just omitting the spaces. Both were shown when at the Add Auto-Extracted Field window, like this:
"Field Name" (original)
"FieldName" (automatically created)

I moved my app to another search head, but I can't create the same datamodel, because of the spaces ...
I get the " Field Name can not contain whitespace, double quotes, single quotes, curly braces or asterisks. " error message.

How to fix this ?

1 Solution

szabados
Communicator

The issue was on my side...I forgot that in my props.conf I've explicitly defined the header to use, that's why I had field names without spaces.

View solution in original post

0 Karma

szabados
Communicator

The issue was on my side...I forgot that in my props.conf I've explicitly defined the header to use, that's why I had field names without spaces.

0 Karma

kishorksudha
Explorer

Anyone could find a solution to this

0 Karma
Get Updates on the Splunk Community!

Aligning Observability Costs with Business Value: Practical Strategies

 Join us for an engaging Tech Talk on Aligning Observability Costs with Business Value: Practical ...

Mastering Data Pipelines: Unlocking Value with Splunk

 In today's AI-driven world, organizations must balance the challenges of managing the explosion of data with ...

Splunk Up Your Game: Why It's Time to Embrace Python 3.9+ and OpenSSL 3.0

Did you know that for Splunk Enterprise 9.4, Python 3.9 is the default interpreter? This shift is not just a ...