Hi Splunkers!
Newbie here in Splunk.
Starting to learn how to develop using splunk.
Can someone help me find a way to make my .CONFs work for Auto Header Field Extraction (Windows Os).
Here's a sample code below..
props.CONF
[details]
NO_BINARY_CHECK = 1
pulldown_type = 1
REPORT-AutoHeader=extract_details
transforms.CONF
[extract_details]
DELIMS=","
FIELDS="UserName","CaseID","Subject","Action"
_
I already put the props.CONF and transforms.CONF both on
C:\Program Files\Splunk\etc\system\local
and C:\Program Files\Splunk\etc\apps\myapp\local
I also restarted splunk.
can someone help me resolve this issue. Thanks!
shariinPH
You can try to use header extraction for this if running Splunk 6:
http://docs.splunk.com/Documentation/Splunk/latest/Data/Extractfieldsfromfileheadersatindextime
In props.conf
[details]
INDEXED_EXTRACTIONS=CSV
There are additional controls as well if the header is not on the first line or is prefaced by other garbage.