what's the best way to set a sedcmd in props to remove spaces and add a " _ " in just the a cvs header line? for example- I have a csv header like this; field 1, field 2, filed 3 and I want the fields to be field_1, field_2, filed_3 but just for the header, not for the data in the fields.  I see this in a old post but, it will change everything with a space even the data: inputs.conf [monitor://c:\temp\sed-csv.log] disable=false index=sedcsv sourcetype=sedcsv props.conf [sedcsv] SEDCMD-replacespace = s/ /_/g https://community.splunk.com/t5/Splunk-Search/CSV-Field-Extraction-with-spaces-in-field-name/m-p/245974  ... View more

I was able to set indexes dynamically in inputs.conf based off the source path folder name however, it seems like its not working in Splunk cloud. I have tried to upload a app with the props and transforms and also tried to use a HWF as well. hoping someone out there might be able to help.    this is basically what my conf files look like- -props- [source::\\fileshare\\folder\\...] TRANSFORMS=send_to_index_by_source   -transforms- [send_to_index_by_source] SOURCE_KEY=_MetaData:Source REGEX=\\\wfileshare\\\wfolder\\(\w+) DEST_KEY=_MetaData:Index FORMAT=$1 -inputs- [monitor://\\fileshare\folder\...\test15.txt] disabled=false recursive=true sourcetype=test15   ... View more

is there a way to add a drop down option to a dashboard that can change what csv lookup it uses?        ... View more

for the new Dashboard Studio, is there a way to add in the options to export CSV or PDF like in the old dashboard app? We only have the option to export .png.  ... View more