How to get fields from tab limited log files with single header?

[tirusplunk]

How to get fields from tab limited log files with single header?

I could not find the following files inputs.conf and prop.conf in directory $SPLUNK_HOME/etc/system/local to set the fields. Is there another way to do it?

Thanks,
Tirumal

[lukejadamec]

After you create your inputs.conf and props.conf you will need to create some configuration items to make this work. You did not provide a lot of details, so you'll have to fill in the blanks:

inputs.conf

[monitor://blank]  
disabled = false  
sourcetype = yourblanksourcetype

props.conf

[yourblanksourcetype]
MAX_TIMESTAMP_LOOKAHEAD = blank
SHOULD_LINEMERGE = blank
CHECK_FOR_HEADER = true
HEADER_FIELD_DELIMITER = \t
TZ = blank

[martin_mueller]

If you don't have a .conf file in */local yet you can create an empty file and start from there.