Auto Header Field Extraction (Windows Os)

[shariinPH]

Hi Splunkers!

Newbie here in Splunk.

Starting to learn how to develop using splunk.

Can someone help me find a way to make my .CONFs work for Auto Header Field Extraction (Windows Os).
Here's a sample code below..

props.CONF

[details]
NO_BINARY_CHECK = 1
pulldown_type = 1
REPORT-AutoHeader=extract_details

transforms.CONF

[extract_details]
DELIMS=","
FIELDS="UserName","CaseID","Subject","Action"

_

I already put the props.CONF and transforms.CONF both on
C:\Program Files\Splunk\etc\system\local

and C:\Program Files\Splunk\etc\apps\myapp\local

I also restarted splunk.
can someone help me resolve this issue. Thanks!

shariinPH

[ogdin]

You can try to use header extraction for this if running Splunk 6:

http://docs.splunk.com/Documentation/Splunk/latest/Data/Extractfieldsfromfileheadersatindextime

In props.conf


[details]
INDEXED_EXTRACTIONS=CSV


There are additional controls as well if the header is not on the first line or is prefaced by other garbage.