Monitored CSV where the headers and number of columns are determined by one of the fields.

[nikorc]

I need to monitor a csv file where the first 6 column headers are static but based on the 3rd column (a number 0-5) the next number of columns are dynamic as are their headers. I trying to understand how to configure the .conf files to have a dynamic set of headers based on the value of a column in the csv when sending to splunk.

[jkat54]

In props.conf you have this option:

HEADER_FIELD_LINE_NUMBER = <integer>
* The line number of the line within the specified file or source that
  contains the header fields.
* If set to 0, Splunk software attempts to
  locate the header fields within the file automatically.
* Default: 0

Does it work?