School|Month|SubjectA|SubjectB is the first line in my data and there are no empty lines before.
my inputs.conf
[monitor:///opt/testdata/multikv]
disabled = false
followTail = 0
host = datav1
index = multikv
sourcetype = datav1
"index=multikv sourcetype=datav1" gives only 1 event which is the 4 lines of my data (1 header, 3 data)
"index=multikv sourcetype=datav1 | multikv conf=testmultikv | table School Month SubjectA SubjectB" gives "No results found"
I'm running Splunk 5.0.2, build 149561.
... View more