Splunk Search

SEDCMD to remove spaces in csv header fields

sbattista
Explorer

what's the best way to set a sedcmd in props to remove spaces and add a " _ " in just the a cvs header line? for example-

I have a csv header like this;

field 1, field 2, filed 3

and I want the fields to be

field_1, field_2, filed_3

but just for the header, not for the data in the fields. 

I see this in a old post but, it will change everything with a space even the data:

inputs.conf
[monitor://c:\temp\sed-csv.log]
disable=false
index=sedcsv
sourcetype=sedcsv

props.conf
[sedcsv]
SEDCMD-replacespace = s/ /_/g

https://community.splunk.com/t5/Splunk-Search/CSV-Field-Extraction-with-spaces-in-field-name/m-p/245974 

0 Karma

FrankVl
Ultra Champion

Is the list of fields known and static? Then you can use the props.conf setting 

FIELD_NAMES = field_1, field_2, field_3

to tell splunk what field names to use, rather than take them from the header row.

0 Karma

sbattista
Explorer

sorry, I should have said this will be dynamic across about 50 or so different CSV's with different headers. 

0 Karma
Get Updates on the Splunk Community!

3-2-1 Go! How Fast Can You Debug Microservices with Observability Cloud?

3-2-1 Go! How Fast Can You Debug Microservices with Observability Cloud? Learn how unique features like ...

Leverage Cisco Talos Threat Intelligence Across Splunk Security Products

Leverage Cisco Talos Threat Intelligence Across Splunk Security Products   Security Edition   Have you ...

What’s New in Splunk Enterprise 9.4: Tools for Digital Resilience

What’s New in Splunk Enterprise 9.4: Tools for Digital Resilience Tune in to What’s New in Splunk Enterprise ...