I've got a data source with a header like this
IP Address,Internal Domain,External Domain,Internal Dns,External Dns,Known,Target,Open Ports,Closed Ports,Mixed Ports,Error Ports,**Confidence**,Match Type,Expression,Match,Value,**Confidence**,Match Type,Expression,Match,Value,**Confidence**,Match Type,Expression,Match,Value,**Confidence**,Match Type,Expression,Match,Value,**Confidence**,Match Type,Expression,Match,Value,Routing Device,Stealth,Switching Device,Sensor,Host,Asname,Netblock,Dns Resolver,Name,Id,Managed Router,Forwarder,Unauthorized Perimeter,Has Traces,Has Responses,Filtering Icmp,Broadcaster,In Snmp Discovered Cidr,In Snmp Responder,In Target Cidr,In Known Cidr,Leaking Inbound,Leaking Outbound,Perimeter Node,Leaking Routing Device,Ipv6 Enabled,Is Snmp Accessible,Filtering Device,Filtering Path,Bgp Router,Snmp Interface,Ld Router
Note there are five times that Confidence shows up in the header. Other than editing the header before ingesting it into Splunk, is there a way in Splunk of renaming the header columns prior to ingesting the data? What happens now is if there are 4 values for **Confidence** then when viewed in the UI the data looks like this
**Confidence**
Value 1
Value 2
Value 3
Value 4
This makes it hard to know what the **Confidence** is associated with.
TIA
↧