I have a Splunk event with the following lines logged from a .txt file. HeaderField1 | HeaderField2 | HeaderField3 HeaderValue1 | HeaderValue2 | HeaderValue3 How can I manipulate the event (and future events) using configuration files (props and/or transform) so that the event text is replaced with the following extracted fields names and values: HeaderField1 = HeaderValue1 HeaderField2 = HeaderValue2 HeaderField3 = HeaderValue3 Note: The actual header field names are always the same. The Header Values change in each text file.
... View more