I have found a "solution" that fits for me: PROPS.CONF [my_sourcetype] CHARSET = ISO-8859-1 TZ = America/Sao_Paulo TIME_PREFIX = \" # Line to get first field as timestamp TIME_FORMAT=%s MAX_TIMESTAMP_LOOKAHEAD=10 SHOULD_LINEMERGE = false disabled = false pulldown_type = true KV_MODE = none NO_BINARY_CHECK = true PREAMBLE_REGEX = .CLM_NUMBER" #Line to avoid header indexing SEDCMD-changeeventformat1 = s/(\"[^\"]\"),(\"[^\"]\"),(\"[^\"]\")/clm_timestamp=\1 clm_date=\2 clm_number=\3/g SEDCMD-changeeventformat2 = s/ \w+=\"\"//g #This line deletes empty fields Not a beautiful solution but after hours of tries is the only solution I have found. Hope is helpful for others. ... View more

I have found a "solution" that fits for me: PROPS.CONF [my_sourcetype] CHARSET = ISO-8859-1 TZ = America/Sao_Paulo TIME_PREFIX = \" # Line to get first field as timestamp TIME_FORMAT=%s MAX_TIMESTAMP_LOOKAHEAD=10 SHOULD_LINEMERGE = false disabled = false pulldown_type = true KV_MODE = none NO_BINARY_CHECK = true PREAMBLE_REGEX = .Header3" #Line to avoid header indexing SEDCMD-changeeventformat1 = s/(\"[^\"]\"),(\"[^\"]\"),(\"[^\"]\")/Header1=\1 Header2=\2 Header3=\3/g SEDCMD-changeeventformat2 = s/ \w+=\"\"//g #This line deletes empty fields TRANSFORMS-company = company_transform TRANSFORMS.CONF [company_transform] REGEX = .FILE_NAME. FORMAT = $0 company="100" companydesc="MY COMPANY" SOURCE_KEY = MetaData:Source WRITE_META = true DEST_KEY = _raw Not a beautiful solution but after hours of tries is the only solution I have found. Hope is helpful for others. ... View more