Splunk Search

How to edit automatic field extractions

clintla
Contributor

I have some automatic field extractions specified in Props.conf per below

INDEXED_EXTRACTIONS=CSV
HEADER_FIELD_LINE_NUMBER=1

They work great and they are extracting about 30 columns but about 5 have 2 words

& I have to specify in each search to rename using one word.

I dont really see any config place to just remove the space in the automatic extraction.
Is there anyway to just make this change to these few extraction names in any config files?

Labels (2)
0 Karma

venkatasri
SplunkTrust
SplunkTrust

Hi @clintla 

If you haven't set the following key meaning default behaviour takes care of words, then words with spaces would replaced with _. For example "customer name" would be seen as "customer_name" in search results.

HEADER_FIELD_ACCEPTABLE_SPECIAL_CHARACTERS = <string>
* This setting specifies the special characters that are allowed in header
  fields.
* When this setting is not set, the processor replaces all characters in header
  field names that are neither alphanumeric or a space (" ") with underscores.
  * For example, if you import a CSV file, and one of the header field names is
    "field.name", the processor replaces "field.name" with "field_name", and
    imports the field this way.

 Is that something you are looking for?

0 Karma