Splunk Search

SEDCMD to remove spaces in csv header fields

sbattista
Explorer

what's the best way to set a sedcmd in props to remove spaces and add a " _ " in just the a cvs header line? for example-

I have a csv header like this;

field 1, field 2, filed 3

and I want the fields to be

field_1, field_2, filed_3

but just for the header, not for the data in the fields. 

I see this in a old post but, it will change everything with a space even the data:

inputs.conf
[monitor://c:\temp\sed-csv.log]
disable=false
index=sedcsv
sourcetype=sedcsv

props.conf
[sedcsv]
SEDCMD-replacespace = s/ /_/g

https://community.splunk.com/t5/Splunk-Search/CSV-Field-Extraction-with-spaces-in-field-name/m-p/245974 

0 Karma

FrankVl
Ultra Champion

Is the list of fields known and static? Then you can use the props.conf setting 

FIELD_NAMES = field_1, field_2, field_3

to tell splunk what field names to use, rather than take them from the header row.

0 Karma

sbattista
Explorer

sorry, I should have said this will be dynamic across about 50 or so different CSV's with different headers. 

0 Karma
Get Updates on the Splunk Community!

Splunk Observability as Code: From Zero to Dashboard

For the details on what Self-Service Observability and Observability as Code is, we have some awesome content ...

[Puzzles] Solve, Learn, Repeat: Character substitutions with Regular Expressions

This challenge was first posted on Slack #puzzles channelFor BORE at .conf23, we had a puzzle question which ...

Shape the Future of Splunk: Join the Product Research Lab!

Join the Splunk Product Research Lab and connect with us in the Slack channel #product-research-lab to get ...