Hello,
We have to import a csv file that always contains the same amount of column (and corresponding values), but the system that generates it sometimes change the order of the header columns, like this:
File01.csv
field01,field02,field03
File02.csv
field03,field01,field02
Is there any way to ingest the file without using in props.conf this set-up?
INDEXED_EXTRACTIONS=csv
The reason is that using the INDEXED_EXTRACTIONS Splunk is adding those fields in the .tsidx and we would like to avoid that.
Thanks a lot,
Edoardo
