Header Field and Values

[bartstk18]

I have a Splunk event with the following lines logged from a .txt file.

HeaderField1 | HeaderField2 | HeaderField3

HeaderValue1 | HeaderValue2 | HeaderValue3

How can I manipulate the event (and future events) using configuration files (props and/or transform) so that the event text is replaced with the following extracted fields names and values:

HeaderField1 = HeaderValue1

HeaderField2 = HeaderValue2

HeaderField3 = HeaderValue3

Note: The actual header field names are always the same. The Header Values change in each text file.

[richgalloway]

I've done that in the past.  The only way I could figure out to do it was to write a python script that read the file, reformatted it, and wrote the results to stdout for indexing.

[scelikok]

That setting should be in Search Head, and will affect already indexed and future data.

Can you please share a few lines of data from your txt file and your sourcetype configuration?

[bartstk18]

@scelikokUnfortunately this did not work. The event has been logged the same and the fields were not extracted.

[scelikok]

Hi @bartstk18,

You can use below settings in conf files,

props.conf
[txt_sourcetype]
REPORT-fieldname=field_headers

transforms.conf
[field_headers]
DELIMS = "|"
FIELDS = HeaderField1 HeaderField2 HeaderField3 

If this reply helps you an upvote is appreciated.