Hi All,
I am trying to load files with headers. The files are simple pipe-separated files. I use the following in props.conf:
FIELD_DELIMITER="|"
In this case, the file is indexed, but the fields are not shown.
If I omit the ", like this:
FIELD_DELIMITER=|
the file is not indexed at all.
If I change all pipes to commas in the input file, and use
FIELD_DELIMITER=,
the file gets indexed, and the fields are all there.
Is there a way to get Splunk load pipe separated files? I don't want to define the fields in transform, because they keep changing from file to file.
Thanks,
Ambrus
... View more