Splunk Search

SEDCMD to remove spaces in csv header fields

sbattista
Explorer

what's the best way to set a sedcmd in props to remove spaces and add a " _ " in just the a cvs header line? for example-

I have a csv header like this;

field 1, field 2, filed 3

and I want the fields to be

field_1, field_2, filed_3

but just for the header, not for the data in the fields. 

I see this in a old post but, it will change everything with a space even the data:

inputs.conf
[monitor://c:\temp\sed-csv.log]
disable=false
index=sedcsv
sourcetype=sedcsv

props.conf
[sedcsv]
SEDCMD-replacespace = s/ /_/g

https://community.splunk.com/t5/Splunk-Search/CSV-Field-Extraction-with-spaces-in-field-name/m-p/245974 

Labels (1)
0 Karma

FrankVl
Ultra Champion

Is the list of fields known and static? Then you can use the props.conf setting 

FIELD_NAMES = field_1, field_2, field_3

to tell splunk what field names to use, rather than take them from the header row.

0 Karma

sbattista
Explorer

sorry, I should have said this will be dynamic across about 50 or so different CSV's with different headers. 

0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...