I have some table formatted data coming into Splunk where the field names are on the second row. Creating a search that uses multikv is easy enough
... | multikv forceheader=2
What I'm wondering is how to translate that to either the props or transforms.conf as simply doing KV_MODE=multi doesn't do the trick.
↧