Do you have to use autoheaders/CHECK_FOR_HEADER? if you're configuring the delims yourself, you you shouldn't be using that anyway I think.
Forums: SplunkGeneral: CSV autoheader does not seem to work with | delimiter
Previous Topic: can only parse strings error | Next Topic: Can't get events to display given a source
Posts 1–2 of 2
| Post to this topic
I'm not able to get CSV autoheader to work with CSV files that are delimited with a pipe (|). The DELIMS field in transforms.conf seems to ignore the pipe symbol.
The reason why this delimiter is used is because columns can contain any other random character (also quotes).
Comma-separated CSV files are working fine.
I've been using this procedure : http://www.splunk.com/base/Documentation/4.0.10/Knowledge/Extractfieldsatindextimebasedonfileheaders
Post to this topic
You must be logged in to post a reply.