PROPS Configuration with CSV Header- Requesting feedback and if there is a way to change field name

[SplunkDash]

Hello,

I have CSV (with epoch time) source files (file with a few sample events given below) with header info. I wrote a props configuration file (see below). I tested this props with a few events and working as expected. Do you have any recommendation on this props configuration file or I am good to go with this props.conf? Also is there any way I can change the field name (i.e., id as ID, created as TIMESTAMP.........so on)? Your feedback and help will be highly appreciated. Thank you so much.

Sample csv with epoch time:

SplunkDash_0-1646332133422.png

props.conf that I Wrote:prop

[ csv ]

SHOULD_LINEMERGE=false

CHARSET=UTF-8

INDEXED_EXTRACTIONS=csv

category=Structured

HEADER_FIELD_LINE_NUMBER=1

TIMESTAMP_FIELDS=created

TIME_FORMAT=%s%9N

MAX_TIMESTAMP_LOOKAHEAD=14

[richgalloway]

The existing props look good to me.

I don't know that you can rename fields, but you can create new fields using the EVAL or FIELDALIAS properties.

EVAL-ID = id
FIELDALIAS-someuniquename = created as TIMESTAMP