again, taking the example of TA_nix bandwidth.sh event: Name rxPackets_PS txPackets_PS rxKB_PS txKB_PS
eth0 1024.00 1972.50 1415.04 674.94 one can easily recognize (and setup extraction mechanisms for) the fields because of the header row... however, if the header row is not there, how do you do it? ----------------------------------------------------------------------------------------------- i agree the multikv events are well formatted but i still do not understand how splunk: recognizes the fields correctly in absence of a header row get values for category & collection when those values are not present in the _raw event the only logical explanation that i can arrive at is: the header row (or something similar, which aids splunk in identifying the fields) is generated at the UF level; but once the event reaches the indexer tier, it is discarded after field extraction, to save license cost & disk space.. i want to know : if this assumption is correct the config that processes the PerfmonMk:<> sourcetypes ---------------------------------------------------------------------------- i am sure i am missing SOMETHING here..
... View more