Getting Data In

Changing CSV file header

jwhughes58
Communicator

I'm working with a csv file with this header

Filenm,EIN,Status,Business Function,Maintained By, Region,Manufacturer Name,Building Name,Service Area,Model Name,Model Number,Serial Number,AM Tag Number,Equipment Type,Equipment Type Description,Network Connection Type Wired,IP Address v4 Wired,Nuvolo Flag,MAC Address Wired,Equipment Status Detail,Network Connection Type Wireless,IP Address v4 Wireless,IP Address Type Wireless,IP Address Type Wired,MAC Address Wireless,Host Name,Fully Qualified Domain Name,OS Version,Asset Type,Contains ePHI,Application Software Name

What I would like to do is have Splunk transform to closer to Splunk field names.  Such as

filenm,ein,status,business_function,maintained_by,region,manufacturer_name,building_name,service_area,model_name,model_number,serial_number,am_tag_mumber,equipment_type,equipment_type_description,network_connection_type_wired,ip_addres_v4_Wired,nuvolo_flag,mac_address_wired,equipment_status_detail,network_connection_type_wireless,ip_Address_v4_wireless,ip_address_type_wireless,ip_ddress_type_wired,mac_address_wireless,host_name,fully_qualified_domain_name,os_version,asset_type,contains_ephi,application_software_name

The only thing I've been able to find is putting something in the TA transforms.conf like this

[edge_asset_header]
DELIMS = ","
FIELDS = "filenm","ein","status","business_function","maintained_by","region","manufacturer_name","building_name","service_area","model_name","model_number","serial_number","am_tag_mumber","equipment_type","equipment_type_description","network_connection_type_wired","ip_addres_v4_Wired","nuvolo_flag","mac_address_wired","equipment_status_detail","network_connection_type_wireless","ip_Address_v4_wireless","ip_address_type_wireless","ip_ddress_type_wired","mac_address_wireless","host_name","fully_qualified_domain_name","os_version","asset_type","contains_ephi","application_software_name"

Is the only solution or did I miss something?

TIA,

Joe

Labels (3)
0 Karma
1 Solution

gcusello
Legend

Hi @jwhughes58,

you solution should work.

but anyway, there's also the approach that's used in normalization: create a set of aliases in yout App or TA, (not in a single search) that could be useful also wgen there are other fields named in those ways to rename.

I always normalize my field names in extraction for using also in other apps.

Ciao.

Giuseppe 

View solution in original post

gcusello
Legend

Hi @jwhughes58,

you solution should work.

but anyway, there's also the approach that's used in normalization: create a set of aliases in yout App or TA, (not in a single search) that could be useful also wgen there are other fields named in those ways to rename.

I always normalize my field names in extraction for using also in other apps.

Ciao.

Giuseppe 

Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...