Splunk Search

fields that begin with a number

alexl1
Path Finder

I have a bunch of fields that begin with a number, which Splunk doesn't allow, is there a way to put an alpha character in front in props.conf so they get indexed?

Tags (1)
0 Karma
1 Solution

alexl1
Path Finder

props.conf

[my_sourcetype]
REPORT-cleanupkeys = clean_my_keys

transforms.conf

[clean_my_keys]
REGEX = ^([^=]*)=([^\n]*)
FORMAT = $1::$2
CLEAN_KEYS = false

View solution in original post

0 Karma

alexl1
Path Finder

props.conf

[my_sourcetype]
REPORT-cleanupkeys = clean_my_keys

transforms.conf

[clean_my_keys]
REGEX = ^([^=]*)=([^\n]*)
FORMAT = $1::$2
CLEAN_KEYS = false
0 Karma

kristian_kolb
Ultra Champion

Hi, i think you can keep your fields with the starting with a number, if you use a REPORT transform for the extraction, and set CLEAN_KEYS = false

http://docs.splunk.com/Documentation/Splunk/5.0.2/Knowledge/Createandmaintainsearch-timefieldextract...
http://docs.splunk.com/Documentation/Splunk/5.0.2/Knowledge/Createandmaintainsearch-timefieldextract...

/K

0 Karma

alexl1
Path Finder

is there a way to do it at the indexing layer?

0 Karma
Get Updates on the Splunk Community!

September Community Champions: A Shoutout to Our Contributors!

As we close the books on another fantastic month, we want to take a moment to celebrate the people who are the ...

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...