automatic header based extraction

[Tridi123]

can any one know how to do it?

[ogdin]

http://docs.splunk.com/Documentation/Splunk/latest/Data/Extractfieldsfromfileheadersatindextime

[alacercogitatus]

See here: http://docs.splunk.com/Documentation/Splunk/4.3.4/Data/Extractfieldsfromfileheadersatindextime#Enabl...

And for a different way see : http://splunk-base.splunk.com/answers/60316/how-to-enable-automatic-header-based-field-extraction

[alacercogitatus]

If this has answered your question, please accept it. Thanks!