Reference: Column customizations

Use column customizations to modify how data from your connection source is sent to the destination. You can do the following:

  • Send custom columns
  • Send a subset of the columns
  • Change the column name sent to the destination

  • Update the column value data type

  • Reorder the columns for supported formats (CEF, CSV, Delimiter Separated Values, HTML, JSON, LEEF, or Syslog RFC 5424)

Column customizations require a source and a destination, and apply only to the configured connection. You can modify one or more columns for the connection, and send the remaining data without changes.

Column customizations consume additional resources for each connection run.

For the best results, if you use any sensors with a TDS Registered Sensor label as a column customization, rather than updating an existing connection, create a new connection with these custom columns, then disable and delete your existing connection.

Send custom columns to the destination

You can send the following custom column values:

  • Connection Variable, which sends the Connection Name, Connection Run ID, or Source Name

  • Timestamp of when the data is sent

  • User Specified Value as a numeric, string, or unmodified value

You can add multiple custom columns for each connection.

  1. From the Create Connection page, in the Configuration section, select a Source and Destination.
  2. Select Configure Output > Columns.

  3. Click + Add Column.

  4. Enter a Source Column Name.

  5. Select a Custom Column Type. You have the following options:

    • If you select Connection Variable, select a Value Type and Destination Value.

    • If you select Timestamp, select the Date/Time Value Type and a Date/Time Format:

      Date/Time Format Output format Example
      MM/DD/YYYY MM/DD/YYYY 01/03/2000 - January 3, 2000
      ISO 8601 with time zone (formerly RFC-3339 Timestamp) YYYY-MM-DDThh:mm:ss+hh:mm, with the time zone offset set to either the local time zone, or Coordinated Universal Time (UTC) if the column input or Tanium Server time zone is UTC 2000-01-03T04:05:06-05:00 - January 3, 2000 at 04:05:06 in Eastern Standard Time (UTC-05:00)
      ISO 8601 UTC (Zulu) YYYY-MM-DDThh:mm:ssZ, with the timestamp set to UTC 2000-01-03T04:05:06Z - January 3, 2000 at 04:05:06 in UTC
    • If you select User Specified Value, select a Value Type and enter a Destination Value.

Customize the source columns sent to the destination

  1. In the Columns section, select which source columns to send to the destination. Select a Source checkbox to send the column values, or clear a Source checkbox to not send the column values.
  2. Update a column name. Enter a Destination Label, or select one from the dropdown list if you selected the CEF output format.
  3. Update a column's data type. Select a Value Type from the dropdown list, or select Unmodified if you do not want to change the data type. Note the following:

    • If you choose Numeric for the value, you can specify a default value that is used if the data cannot be coerced into a numeric value. You can specify any negative or positive number.

    • If you choose Date/Time for the value, specify the format that you want to use for the column.

  4. Reorder how the data values are sent to the destination if you select the CSV, Delimiter Separated Values, LEEF, or Syslog RFC 5424 output format. Click Reorder Columns. Drag the columns into the desired order, then click Confirm.