I'm aware and mentioned the script option in my question. But running the data through a script beforehand would be twice as computationally expensive (or more). I also anticipate similar files with different field sets in the future, hence I would need to touch/modify the script for each of these files. (Running the data through a sed/awk/perl script beforehand is certainly possible, but given the size of the file this would be computationally expensive. And as Splunk already extracts the field headers, it appears to me that excluding columns from import would be the cleaner and more efficient approach. Furthermore, it is likely that I will have to deal with similar files (that have different fieldsets or column orders) in the future.) ... View more