Hello,  We are also trying to find out the same. Were you able to figure out the difference or get any response from Splunk. ... View more

Thanks for the Link, sundareshr. My approach would be something like the following: props.conf: [someSourcetype] TRANSFORMS-first = NoHeader TRANSFORMS-second= csv-fieldextraction transforms.conf: [NoHeader] REGEX = "Time","IOPS","Latency(ms)","BW (MBps)" DEST_KEY = queue FORMAT = nullQueue [csv-fieldextraction] DELIMS="," FIELDS="Time","IOPS","Latency","BW (MBps)" Still, the configuration is bond to a specific set of fields. Did you mean that or do you have something different in mind? ... View more