fields that begin with a number

[alexl1]

I have a bunch of fields that begin with a number, which Splunk doesn't allow, is there a way to put an alpha character in front in props.conf so they get indexed?

[alexl1 · Accepted solution]

props.conf

[my_sourcetype]
REPORT-cleanupkeys = clean_my_keys

transforms.conf

[clean_my_keys]
REGEX = ^([^=]*)=([^\n]*)
FORMAT = $1::$2
CLEAN_KEYS = false

[kristian_kolb]

Hi, i think you can keep your fields with the starting with a number, if you use a REPORT transform for the extraction, and set CLEAN_KEYS = false

http://docs.splunk.com/Documentation/Splunk/5.0.2/Knowledge/Createandmaintainsearch-timefieldextract...
http://docs.splunk.com/Documentation/Splunk/5.0.2/Knowledge/Createandmaintainsearch-timefieldextract...

/K

[alexl1]

is there a way to do it at the indexing layer?