I have been following this documentation;
No combination of props.conf settings appears to be working. Here is the data template of the file I am attempting to bring in;
My assumed props.conf;
[SourceTypeName] FIELD_DELIMITER=| NO_BINARY_CHECK=1 SHOULD_LINEMERGE=false
Any ideas? I can edit the props.conf during the data add "wizard" and it updates the local conf file appropriately, however each event is still shown as a single line without field information;
Can't post images so replace the 'xx' with 'tt'; hxxp://i.imgur.com/vAKOJFY.png
You don't want to use
CHECK_FOR_HEADER in combination with indexed extractions.
CHECK_FOR_HEADER is a deprecated technique we used for search-time field extractions.
In props.conf, use: