configuring field extraction

[Tridi123]

Hi,
I want to enable automatic field extraction from header. My file looks like this format

emp|age|place

12345|28|india

how can i configure my prop.conf amd transform.conf file for this.I studied getting data manual but seems not woking for me. Can u assit me by giving me the code detail.As i am doing poc on it.

[yannK]

For a search time manual field extraction with a regex.

mysearch | rex "(?[^|])\|(?[^|])\|(?[^|]*)" | table emp age place

For an automatic field extraction,

see http://docs.splunk.com/Documentation/Splunk/4.3.4/Data/Extractfieldsfromfileheadersatindextime
on the search-head or indexer, define a search time field extraction for your sourcetype.
in props.conf

[mysourcetype]

TRANSFORMS-mysourcetypefields = mysourcetypefieldsextraction

in transforms.conf

[mysourcetypefieldsextraction]

FIELDS="emp", "age", "place"

DELIMS="|"

[Simon]

Did you try KV_MODE = multi in props.conf (http://docs.splunk.com/Documentation/Splunk/4.3.4/admin/Propsconf) ?

[Tridi123]

To turn on automatic header-based field extraction for a source or source type, add CHECK_FOR_HEADER=TRUE then [deatils]--------------sourcetype CHECK_FOR_HEADER=TRUE
then should i give KV_MODE = multi

[Tridi123]

link is not opening