how to Enable automatic header-based field extraction

[Tridi123]

Hi, I want to enable automatic field extraction from header. My file looks like this format

emp|age|place

12345|28|india
234567|24|UK

how can i configure my prop.conf amd transform.conf file for this.I studied getting data manual but seems not woking for me. Can u assit me by giving me the code detail.

To turn on automatic header-based field extraction for a source or source type,
add CHECK_FOR_HEADER=TRUE
then
[deatils]--------------sourcetype
CHECK_FOR_HEADER=TRUE
after that i am not understading the code Can any one provide me the detail process.

[alacercogitatus]

I prefer to use props and transforms differently to do these extractions. This will make it so you dont have to have headers in the file. Try this:

Props.conf
[deatils]
REPORT-ext = deatils_fields

Transforms.conf
[deatils_fields]
DELIM = "|"
FIELDS = "emp", "age", "place"

[Tridi123]

thanks for ur information

[alacercogitatus]

Per http://docs.splunk.com/Documentation/Splunk/latest/admin/Propsconf, it's just away to call the transforms stanza. REPORT, EXTRACT, and TRANSFORMS are all valid there.

[Tridi123]

hi
Thanks for ur response.But Report-ext is any splunk defined variable or we r using for calling transform.conf in Props.conf