The venerable old-skool Splunk forums are now closed. Feel free to search for old content here, but new posts are no longer supported.
Instead, please visit the thriving community at answers.splunk.com to ask and answer questions about your Splunk deployment and how to get the most out of it.
Previous Topic: can only parse strings error | Next Topic: Can't get events to display given a source
Posts 1–2 of 2
I'm not able to get CSV autoheader to work with CSV files that are delimited with a pipe (|). The DELIMS field in transforms.conf seems to ignore the pipe symbol.
The reason why this delimiter is used is because columns can contain any other random character (also quotes).
Comma-separated CSV files are working fine.
I've been using this procedure : http://www.splunk.com/base/Documentation/4.0.10/Knowledge/Extractfieldsatindextimebasedonfileheaders
Do you have to use autoheaders/CHECK_FOR_HEADER? if you're configuring the delims yourself, you you shouldn't be using that anyway I think.