I have exported some data from another Splunk server as a csv file. The file contains multiple source_types and multiple event_types. When I try to reimport the data into a new Splunk server, the multi-value fields do not get tagged separately.
My solution to this was to add conditions to the fields.conf to for the tags to be labeled properly at index time. I can now perform regular searches on the data that I need, however I am unable to apply any data models.
I'm unsure if a better solution would be to apply changes to the props / transforms .conf files. Or is there is some critical element I am missing to apply a data model. Any help/direction is appreciated.
-K
