The header order changes in my monitored CSV file. Is there a way to have the forwarded data follow this order dynamically?

[riotto]

I am monitoring a file that has comma separated values. For example: John, Smith, Maine

The data is being forwarded by a Universal Forwarder. I have the props.conf and transforms.conf set up to receive the data as: firstname, lastname, state

When I search in Splunk -- firstname=John, lastname=Smith, state=Maine

Here's the problem, the order of the data can change in the file, so my fields contain the wrong type of data. Is there a way to
to have the data follow its order dynamically? There is a header that is sent that tells me when the order changes.

[dmaislin_splunk]

Check out indexed_extractions and leverage these new options to extract the structured data fields. NOTE: The indexed_extractions = CSV settings from props.conf are used on the FORWARDER. This method will always ensure that the fields are extracted correctly every time based on the header in the file.

http://docs.splunk.com/Documentation/Splunk/6.5.0/Data/Extractfieldsfromfileswithstructureddata

[riotto]

doesn't the indexed_extractions do indexed time extraction, which I see in lots of documentation to avoid?