I want to enable automatic field extraction from header. My file looks like this format
how can i configure my prop.conf amd transform.conf file for this.I studied getting data manual but seems not woking for me. Can u assit me by giving me the code detail.As i am doing poc on it.
For a search time manual field extraction with a regex.
mysearch | rex "(?
[^|])\|(? [^|])\|(? [^|]*)" | table emp age place
For an automatic field extraction,
on the search-head or indexer, define a search time field extraction for your sourcetype.
TRANSFORMS-mysourcetypefields = mysourcetypefieldsextraction
FIELDS="emp", "age", "place"
To turn on automatic header-based field extraction for a source or source type, add CHECKFORHEADER=TRUE then [deatils]--------------sourcetype CHECKFORHEADER=TRUE
then should i give KV_MODE = multi