Quantcast
Channel: Questions in topic: "props.conf"
Viewing all articles
Browse latest Browse all 1485

Moral equivalent to | multikv forceheader=x in props/transforms?

$
0
0
I have some table formatted data coming into Splunk where the field names are on the second row. Creating a search that uses multikv is easy enough ... | multikv forceheader=2 What I'm wondering is how to translate that to either the props or transforms.conf as simply doing KV_MODE=multi doesn't do the trick.

Viewing all articles
Browse latest Browse all 1485

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>