How to get fields from tab limited log files with single header?
I could not find the following files inputs.conf and prop.conf in directory $SPLUNK_HOME/etc/system/local to set the fields. Is there another way to do it?
Thanks,
Tirumal
After you create your inputs.conf and props.conf you will need to create some configuration items to make this work. You did not provide a lot of details, so you'll have to fill in the blanks:
inputs.conf
[monitor://blank]
disabled = false
sourcetype = yourblanksourcetype
props.conf
[yourblanksourcetype]
MAX_TIMESTAMP_LOOKAHEAD = blank
SHOULD_LINEMERGE = blank
CHECK_FOR_HEADER = true
HEADER_FIELD_DELIMITER = \t
TZ = blank
If you don't have a .conf file in */local yet you can create an empty file and start from there.