I tried to make the changes as suggested by you, but it does not work 😞
Following is sample data, although the actual data is complicated, this is for test purpose.
File Name is "comma.ini"
nagesh,test
nagesh,test1
My props.conf entry:
[ini-too_small]
REPORT-AutoHeader = AutoHeader-ini-too_small
My transforms.conf entry:
[AutoHeader-ini-too_small]
FIELDS="foo", "bar"
DELIMS=","
The sourcetype ini-too_small is assigned by splunk automatically.
I have modified props.conf and transforms.conf in the splunk/etc/users/admin/search/local
Let me know were i am going wrong here.
... View more