what's the best way to set a sedcmd in props to remove spaces and add a " _ " in just the a cvs header line? for example- I have a csv header like this; field 1, field 2, filed 3 and I want the fields to be field_1, field_2, filed_3 but just for the header, not for the data in the fields. I see this in a old post but, it will change everything with a space even the data: inputs.conf
[monitor://c:\temp\sed-csv.log]
disable=false
index=sedcsv
sourcetype=sedcsv
props.conf
[sedcsv]
SEDCMD-replacespace = s/ /_/g https://community.splunk.com/t5/Splunk-Search/CSV-Field-Extraction-with-spaces-in-field-name/m-p/245974
... View more