Hi,
I want to upload a bunch of txt files, therefore I've created a structured sourcetype.
When I add one single file, the preview looks fine and the imported data is correct. But when I upload a .zip of multiple files, Splunk creates multivalue fields for some reason.
*txt:*
column1 | column2 | column3
A | B | C
*index event in Splunk:*
column1 | column2
A | B C
The files can contain different number of columns and in some files the columns can have only a header. Can this be the problem here or do you have another idea?
Thanks in advance
↧