Splunk Search

while indexing csv with slash and hyphen in the header that is getting modified to underscore

surekhasplunk
Communicator

Hi,

I have a csv file which i am indexing first and then generating the output.csv file using savedsearches.conf file.

The data is coming properly but there is a problem with headers. The outputlookup file which is getting generated is converting all the forward slashes and hyphen symbols in the header to underscore.

For ex: column header at source csv file - "First/Last Name","Designation","Skill - Level"
getting converted to destination csv file - "First_Last Name","Designation","Skill_Level"

How do get the headers as it is in the output lookup file ?

Tags (3)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

The headers in a CSV are field names. Splunk field names are restricted to letters, digits, and underscores. Splunk automatically converts invalid field name characters to underscores when it encounters them. You can't change that, otherwise you'd have invalid field names in your index(es).

---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

The headers in a CSV are field names. Splunk field names are restricted to letters, digits, and underscores. Splunk automatically converts invalid field name characters to underscores when it encounters them. You can't change that, otherwise you'd have invalid field names in your index(es).

---
If this reply helps you, Karma would be appreciated.
0 Karma

surekhasplunk
Communicator

Thanks @richgalloway for the clarification.
Then is there any way I can rename them after indexing or add alias name, back to the fieldnames with slash so that the dashboards which are already developed to work with inputlookup field names (with slash) doesn't need to be modified any more.

Thanks
Surekha

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Yes, you can rename them. Try ... | rename "First_Last Name" as "First/Last Name", Skill_Level as "Skill - Level" | ... as the last command before outputlookup.

---
If this reply helps you, Karma would be appreciated.

surekhasplunk
Communicator

Hi @richgalloway,
I have got into another csv file which has # symbol at the beginning of the field names.
So some field names look like this "# Of Employees"
And i have seen after indexing the files and creating the output.csv file i dont get these fields at all.
However am getting the values for those fields.

So can you help me with the rex to create the fields as if i use comma as delimeter then some Name is a field where comma is there inside the name thats getting divided into 2 fields

0 Karma

richgalloway
SplunkTrust
SplunkTrust

The # symbol indicates the beginning of a comment. Avoid using it.
To include a comma in a field put quotation marks around the field.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Database Performance Sidebar Panel Now on APM Database Query Performance & Service ...

We’ve streamlined the troubleshooting experience for database-related service issues by adding a database ...

IM Landing Page Filter - Now Available

We’ve added the capability for you to filter across the summary details on the main Infrastructure Monitoring ...

Dynamic Links from Alerts to IM Navigators - New in Observability Cloud

Splunk continues to improve the troubleshooting experience in Observability Cloud with this latest enhancement ...