I've got a data source with a header like this
IP Address,Internal Domain,External Domain,Internal Dns,External Dns,Known,Target,Open Ports,Closed Ports,Mixed Ports,Error Ports,Confidence,Match Type,Expression,Match,Value,Confidence,Match Type,Expression,Match,Value,Confidence,Match Type,Expression,Match,Value,Confidence,Match Type,Expression,Match,Value,Confidence,Match Type,Expression,Match,Value,Routing Device,Stealth,Switching Device,Sensor,Host,Asname,Netblock,Dns Resolver,Name,Id,Managed Router,Forwarder,Unauthorized Perimeter,Has Traces,Has Responses,Filtering Icmp,Broadcaster,In Snmp Discovered Cidr,In Snmp Responder,In Target Cidr,In Known Cidr,Leaking Inbound,Leaking Outbound,Perimeter Node,Leaking Routing Device,Ipv6 Enabled,Is Snmp Accessible,Filtering Device,Filtering Path,Bgp Router,Snmp Interface,Ld Router
Note there are five times that Confidence shows up in the header. Other than editing the header before ingesting it into Splunk, is there a way in Splunk of renaming the header columns prior to ingesting the data? What happens now is if there are 4 values for Confidence then when viewed in the UI the data looks like this
Confidence
Value 1
Value 2
Value 3
Value 4
This makes it hard to know what the Confidence is associated with.
TIA
Look at this section in the online documentation here http://docs.splunk.com/Documentation/Splunk/6.4.2/Admin/Transformsconf
[extract_csv]
DELIMS = ","
FIELDS = "field1", "field2", "field3"
Look at this section in the online documentation here http://docs.splunk.com/Documentation/Splunk/6.4.2/Admin/Transformsconf
[extract_csv]
DELIMS = ","
FIELDS = "field1", "field2", "field3"
Thanks. I see I was looking at the data the wrong way. Instead of renaming the columns of the header, just read in the data and have the [extract_csv] stanza put the data into the field names I create.