How to extract changing headers from multiline event?

dominikatvastli — Fri, 22 Feb 2019 16:38:32 GMT

Hi all,

I am sending a multiline event to Splunk Enterprise. The first row contains metadata, the second row the field names, the third row the actual values. It looks like this:

***SPLUNK*** host=hostname index=testindex source=testsource sourcetype=testsourcetype
Timestamp,"Arbitrary field name"
1550850412192,89

The field name is arbitrary, which means it is variable. At the first event, it could be "Field name 1" and at the second "Field name 2".

Currently, Splunk shows me two events.
1. Timestamp,"Arbitrary field name"
2. 1550850412192,89

What I want is that it creates a field from the "Arbitrary field name" and assigns value 89.

My props.conf looks like this at the moment:

INDEXED_EXTRACTIONS = csv
FIELD_DELIMITER = ,
HEADER_FIELD_LINE_NUMBER = 2

Re: How to extract changing headers from multiline event?

lakshman239 — Thu, 28 Feb 2019 09:18:11 GMT

Not sure if splunk can natively do that, as it needs to know the field name. In your scenario, how many arbitrary field names would you have? You could try to provide them as a CSV in FIELD_NAMES and see how it works.

https://docs.splunk.com/Documentation/Splunk/7.2.4/Data/Extractfieldsfromfileswithstructureddata#Forward_data_extracted_from_structured_data_files

topic Re: How to extract changing headers from multiline event? in Getting Data In

How to extract changing headers from multiline event?

Re: How to extract changing headers from multiline event?