Hi, I want to enable automatic field extraction from header. My file looks like this format
emp|age|place
12345|28|india
234567|24|UK
how can i configure my prop.conf amd transform.conf file for this.I studied getting data manual but seems not woking for me. Can u assit me by giving me the code detail.
To turn on automatic header-based field extraction for a source or source type,
add CHECK_FOR_HEADER=TRUE
then
[deatils]--------------sourcetype
CHECK_FOR_HEADER=TRUE
after that i am not understading the code Can any one provide me the detail process.
I prefer to use props and transforms differently to do these extractions. This will make it so you dont have to have headers in the file. Try this:
Props.conf
[deatils]
REPORT-ext = deatils_fields
Transforms.conf
[deatils_fields]
DELIM = "|"
FIELDS = "emp", "age", "place"
thanks for ur information
Per http://docs.splunk.com/Documentation/Splunk/latest/admin/Propsconf, it's just away to call the transforms stanza. REPORT, EXTRACT, and TRANSFORMS are all valid there.
hi
Thanks for ur response.But Report-ext is any splunk defined variable or we r using for calling transform.conf in Props.conf