Hi All,
I have a csv looks like below
Name, Description, 1960,1961,1962,1963,1964,....,2013
test, testdescription, 5.3, 5.6, 5.8,5.9,6.2, 6.4, ....., 4.5
test2, testdesc2, 11.3, 11.9, 12.7, 15.8, 19.2, ....., 20.1
When I import to splunk, the field "Name", "Description" extract very well, however, all the field name with only numbers didn't extract.
How to handle such a case?
The reason for your fields not appearing is that Splunk only allows field names to contain a-z, A-Z, 0-9
and _
. Any non-allowed characters in field names are converted to . And field names cannot begin with 0-9
or ``. Thus a purely numerical field name would be converted to just underscores, which are not allowed.
You can create fields that have numerical names through a REPORT
field transform where you set CLEAN_KEYS = false
. (see first link below), but that may not really be what you want, since you might have a hard time to use the fields in certain operations (see second link below).
You might be better off if you could change the CSV headers to start with a letter, e.g. y1960, y1961, y1962 ... y2013
.
http://answers.splunk.com/answers/11014/eval-on-numerically-named-fields
Hope this helps,
K
The reason for your fields not appearing is that Splunk only allows field names to contain a-z, A-Z, 0-9
and _
. Any non-allowed characters in field names are converted to . And field names cannot begin with 0-9
or ``. Thus a purely numerical field name would be converted to just underscores, which are not allowed.
You can create fields that have numerical names through a REPORT
field transform where you set CLEAN_KEYS = false
. (see first link below), but that may not really be what you want, since you might have a hard time to use the fields in certain operations (see second link below).
You might be better off if you could change the CSV headers to start with a letter, e.g. y1960, y1961, y1962 ... y2013
.
http://answers.splunk.com/answers/11014/eval-on-numerically-named-fields
Hope this helps,
K
By not but change the field name because it is with [Field names cannot begin with 0-9]?