Splunk Search

SEDCMD to remove spaces in csv header fields

sbattista
Explorer

what's the best way to set a sedcmd in props to remove spaces and add a " _ " in just the a cvs header line? for example-

I have a csv header like this;

field 1, field 2, filed 3

and I want the fields to be

field_1, field_2, filed_3

but just for the header, not for the data in the fields. 

I see this in a old post but, it will change everything with a space even the data:

inputs.conf
[monitor://c:\temp\sed-csv.log]
disable=false
index=sedcsv
sourcetype=sedcsv

props.conf
[sedcsv]
SEDCMD-replacespace = s/ /_/g

https://community.splunk.com/t5/Splunk-Search/CSV-Field-Extraction-with-spaces-in-field-name/m-p/245974 

Labels (1)
0 Karma

FrankVl
Ultra Champion

Is the list of fields known and static? Then you can use the props.conf setting 

FIELD_NAMES = field_1, field_2, field_3

to tell splunk what field names to use, rather than take them from the header row.

0 Karma

sbattista
Explorer

sorry, I should have said this will be dynamic across about 50 or so different CSV's with different headers. 

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...