what's the best way to set a sedcmd in props to remove spaces and add a " _ " in just the a cvs header line? for example-
I have a csv header like this;
field 1, field 2, filed 3
and I want the fields to be
field_1, field_2, filed_3
but just for the header, not for the data in the fields.
I see this in a old post but, it will change everything with a space even the data:
inputs.conf [monitor://c:\temp\sed-csv.log] disable=false index=sedcsv sourcetype=sedcsv props.conf [sedcsv] SEDCMD-replacespace = s/ /_/g
https://community.splunk.com/t5/Splunk-Search/CSV-Field-Extraction-with-spaces-in-field-name/m-p/245974
Is the list of fields known and static? Then you can use the props.conf setting
FIELD_NAMES = field_1, field_2, field_3
to tell splunk what field names to use, rather than take them from the header row.
sorry, I should have said this will be dynamic across about 50 or so different CSV's with different headers.