topic Removing header from CSV file in Splunk Enterprise

Removing header from CSV file

krish5vuda — Tue, 04 Jan 2022 14:49:50 GMT

I have a CSV file placed in a UF and the CSV data is as follows

'"Name" "userid" "use location" "userdesignation"'

Raj raj-123 Argentina Consultant

Now I have written props and transforms as below but still the header is being ingested

Props:

[Sourcetype]

Should_linemerge=false

Line_Breaker=([\r\n]+)

NO_BINARY_CHECK=true

CHARSET= UTF-8

INDEXED_EXTRACTIONS=CSV

category=structured

description=Comma-separated value format. Set header and other settings in "Delimited Settings"

disabled=false

TRUNCATE=99999

DATETIME_CONFIG=CURRENT

KV_MODE=none

HEADER_FIELD_LINE_NUMBER=1

TRANSFORMS-set=setnull

Transforms.conf

[setnull]

REGEX=(^"NAME".*$) |(^\'\"NAME\".$)

DEST_KEY=queue

FORMAT=nullQueue

Please let me know what changes has to be made so that header is not being ingested

Re: Removing header from CSV file

isoutamo — Tue, 04 Jan 2022 16:16:29 GMT

Have you try this on UF? In UF you cannot use transforms.con and actually you shouldn’t need it as you told that headers are in first row in file. And remember to restart UF after put props.conf there.

Re: Removing header from CSV file

krish5vuda — Tue, 04 Jan 2022 16:18:34 GMT

This conf are in indexer and not in UF

Re: Removing header from CSV file

isoutamo — Tue, 04 Jan 2022 16:21:52 GMT

He is instructions where those files should be in different cases https://wiki.splunk.com/Community:HowIndexingWorks and https://www.aplura.com/assets/pdf/where_to_put_props.pdf.