Am I missing something? My understanding of splunk 6 is that the following configuration should strip all lines beginning with '#' and parse the line beginning with '#fields ' for field names, starting after the text #fields[tab]. However, headers are not being stripped and fields are being parsed beginning with #fields, so they are one column off. I think I need some assistance from someone who understands splunk better than me, because I'm going crazy trying to understand why this isn't working. props.conf: [brolog] PREAMBLE_REGEX=^# FIELD_HEADER_REGEX=^#fields\t FIELD_DELIMITER=\t MISSING_VALUE_REGEX=- ... View more