How to extract changing headers from multiline event?

[dominikatvastli]

Hi all,

I am sending a multiline event to Splunk Enterprise. The first row contains metadata, the second row the field names, the third row the actual values. It looks like this:

***SPLUNK*** host=hostname index=testindex source=testsource sourcetype=testsourcetype
Timestamp,"Arbitrary field name"
1550850412192,89

The field name is arbitrary, which means it is variable. At the first event, it could be "Field name 1" and at the second "Field name 2".

Currently, Splunk shows me two events.
1. Timestamp,"Arbitrary field name"
2. 1550850412192,89

What I want is that it creates a field from the "Arbitrary field name" and assigns value 89.

My props.conf looks like this at the moment:

INDEXED_EXTRACTIONS = csv
FIELD_DELIMITER = ,
HEADER_FIELD_LINE_NUMBER = 2

[lakshman239]

Not sure if splunk can natively do that, as it needs to know the field name. In your scenario, how many arbitrary field names would you have? You could try to provide them as a CSV in FIELD_NAMES and see how it works.

https://docs.splunk.com/Documentation/Splunk/7.2.4/Data/Extractfieldsfromfileswithstructureddata#For...