Hi all,
I am sending a multiline event to Splunk Enterprise. The first row contains metadata, the second row the field names, the third row the actual values. It looks like this:
***SPLUNK*** host=hostname index=testindex source=testsource sourcetype=testsourcetype
Timestamp,"Arbitrary field name"
1550850412192,89
The field name is arbitrary, which means it is variable. At the first event, it could be "Field name 1" and at the second "Field name 2".
Currently, Splunk shows me two events.
1. Timestamp,"Arbitrary field name"
2. 1550850412192,89
What I want is that it creates a field from the "Arbitrary field name" and assigns value 89.
My props.conf looks like this at the moment:
INDEXED_EXTRACTIONS = csv
FIELD_DELIMITER = ,
HEADER_FIELD_LINE_NUMBER = 2
... View more