How can we auto extracted fields from TAB delimited text file with header at index time?

[abhisplunk1]

Hi here is sample format

Audit Log ID KMA ID KMA Name Class Retention Term Operation Condition Severity Audit Log Entry ID Created Date Entity ID Entity Network Address Message Values Solution
B7086B1B57C6714E00000000009D00B1 B7086B1B57C6714E CA4SICLKMA1 Audit Log Management Operations Short Term List Audit Logs Success Success 000109000000 2023-06-05 09:35:11 AKH25wj 30.XXX.XXX.XX No recommended action
B7086B1B57C6714E00000000009D00AF B7086B1B57C6714E CA4SICLKMA1 Audit Log Management Operations Short Term List Audit Logs Success Success 000109000000 2023-06-05 09:35:06 AKH25wj 30.XXX.XXX.XX No recommended action
B7086B1B57C6714E00000000009D00AA B7086B1B57C6714E CA4SICLKMA1 Audit Log Management Operations Short Term List Audit Logs Success Success 000109000000 2023-06-05 09:34:17 AKH25wj 30.XXX.XXX.XX No recommended action

[richgalloway]

A tab-delimited file is just a CSV that uses tabs instead of commas.  Try these props:

[mysourcetype]
INDEXED_EXTRACTIONS = TSV
DATETIME_CONFIG = current

[abhisplunk1]

Logs are coming from UF, so I have tried INDEXED_EXTRACTION=TSV on indexer which did not work for me, then on search head used following example pattern, which did not work either. So I had to create new field extraction using the UI and there select the tab as delimiter and then rename the fields. 

[mysourcetype]
DELIMS = "\t"
FIELDS = field1,f2,fieldthree

[richgalloway]

Note that the correct setting name is INDEXED_EXTRACTIONS.

Putting index-time extractions on a search head will not help because extractions are done by indexers and heavy forwarders.

[PickleRick]

Actually, while "normal" extractions are done on indexers/HFs, indexed extractions are done right on the inputting component even if it's a UF so you need to define INDEXED_EXTRACTIONS on your UF in that case.

Having said that, there is a possibility to use KV_MODE=multi to extract fields from delimited events in search-time.