Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

Is there a way to rename CSV column headers prior to indexing the data?

$
0
0
I've got a data source with a header like this IP Address,Internal Domain,External Domain,Internal Dns,External Dns,Known,Target,Open Ports,Closed Ports,Mixed Ports,Error Ports,**Confidence**,Match Type,Expression,Match,Value,**Confidence**,Match Type,Expression,Match,Value,**Confidence**,Match Type,Expression,Match,Value,**Confidence**,Match Type,Expression,Match,Value,**Confidence**,Match Type,Expression,Match,Value,Routing Device,Stealth,Switching Device,Sensor,Host,Asname,Netblock,Dns Resolver,Name,Id,Managed Router,Forwarder,Unauthorized Perimeter,Has Traces,Has Responses,Filtering Icmp,Broadcaster,In Snmp Discovered Cidr,In Snmp Responder,In Target Cidr,In Known Cidr,Leaking Inbound,Leaking Outbound,Perimeter Node,Leaking Routing Device,Ipv6 Enabled,Is Snmp Accessible,Filtering Device,Filtering Path,Bgp Router,Snmp Interface,Ld Router Note there are five times that Confidence shows up in the header. Other than editing the header before ingesting it into Splunk, is there a way in Splunk of renaming the header columns prior to ingesting the data? What happens now is if there are 4 values for **Confidence** then when viewed in the UI the data looks like this **Confidence** Value 1 Value 2 Value 3 Value 4 This makes it hard to know what the **Confidence** is associated with. TIA

Viewing all articles
Browse latest Browse all 47296

Trending Articles