Splunk Search

How to edit automatic field extractions

clintla
Contributor

I have some automatic field extractions specified in Props.conf per below

INDEXED_EXTRACTIONS=CSV
HEADER_FIELD_LINE_NUMBER=1

They work great and they are extracting about 30 columns but about 5 have 2 words

& I have to specify in each search to rename using one word.

I dont really see any config place to just remove the space in the automatic extraction.
Is there anyway to just make this change to these few extraction names in any config files?

Labels (2)
0 Karma

venkatasri
SplunkTrust
SplunkTrust

Hi @clintla 

If you haven't set the following key meaning default behaviour takes care of words, then words with spaces would replaced with _. For example "customer name" would be seen as "customer_name" in search results.

HEADER_FIELD_ACCEPTABLE_SPECIAL_CHARACTERS = <string>
* This setting specifies the special characters that are allowed in header
  fields.
* When this setting is not set, the processor replaces all characters in header
  field names that are neither alphanumeric or a space (" ") with underscores.
  * For example, if you import a CSV file, and one of the header field names is
    "field.name", the processor replaces "field.name" with "field_name", and
    imports the field this way.

 Is that something you are looking for?

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Your Feedback. Our Roadmap. Visit the PX Feedback Booth at .conf26

You use Splunk every day, come and help shape what's next.  Save Your Seat: Product-Focused Sessions at ...

Agentic SOC Triage: Investigating Splunk ES Notables with MCP Server and a Local LLM

The Problem: Too Many Alerts, Too Little Context Security operations teams running Splunk Enterprise Security ...

Painting a Clearer Picture: Creating Cross-Domain Visibility with AI Canvas

Watch Now Painting a Clearer Picture: Creating Cross-Domain Visibility with AI Canvas     Do you ever feel ...