Splunk Search

how to Enable automatic header-based field extraction

Tridi123
New Member

Hi, I want to enable automatic field extraction from header. My file looks like this format

emp|age|place

12345|28|india
234567|24|UK

how can i configure my prop.conf amd transform.conf file for this.I studied getting data manual but seems not woking for me. Can u assit me by giving me the code detail.

To turn on automatic header-based field extraction for a source or source type,
add CHECK_FOR_HEADER=TRUE
then
[deatils]--------------sourcetype
CHECK_FOR_HEADER=TRUE
after that i am not understading the code Can any one provide me the detail process.

Tags (1)
0 Karma

alacercogitatus
SplunkTrust
SplunkTrust

I prefer to use props and transforms differently to do these extractions. This will make it so you dont have to have headers in the file. Try this:

Props.conf
[deatils]
REPORT-ext = deatils_fields

Transforms.conf
[deatils_fields]
DELIM = "|"
FIELDS = "emp", "age", "place"
0 Karma

Tridi123
New Member

thanks for ur information

0 Karma

alacercogitatus
SplunkTrust
SplunkTrust

Per http://docs.splunk.com/Documentation/Splunk/latest/admin/Propsconf, it's just away to call the transforms stanza. REPORT, EXTRACT, and TRANSFORMS are all valid there.

0 Karma

Tridi123
New Member

hi
Thanks for ur response.But Report-ext is any splunk defined variable or we r using for calling transform.conf in Props.conf

0 Karma
Get Updates on the Splunk Community!

New Cloud Intrusion Detection System Add-on for Splunk

In July 2022 Splunk released the Cloud IDS add-on which expanded Splunk capabilities in security and data ...

Happy CX Day to our Community Superheroes!

Happy 10th Birthday CX Day!What is CX Day? It’s a global celebration recognizing innovation and success in the ...

Check out This Month’s Brand new Splunk Lantern Articles

Splunk Lantern is a customer success center providing advice from Splunk experts on valuable data insights, ...