Newbie here in Splunk.
Starting to learn how to develop using splunk.
Can someone help me find a way to make my .CONFs work for Auto Header Field Extraction (Windows Os).
Here's a sample code below..
NO_BINARY_CHECK = 1
pulldown_type = 1
I already put the props.CONF and transforms.CONF both on
and C:\Program Files\Splunk\etc\apps\myapp\local
I also restarted splunk.
can someone help me resolve this issue. Thanks!
You can try to use header extraction for this if running Splunk 6:
There are additional controls as well if the header is not on the first line or is prefaced by other garbage.