I want to index a shell script output thro inputs.conf.
I have configured the script
[script://$SPLUNK_HOME/etc/apps/search/bin/swapmem.sh]
disabled = false
host = *
index = index_perform
interval = 30
source = Perform
sourcetype = Memory
the output script is
total used free shared buff/cache available
Swap: 32767 919 31848
i want to index the first line as header as auto and map the fields vice versa but the output indexes the both lines .