topic Re: Removing Header row after outputcsv command in Getting Data In

Removing Header row after outputcsv command

efelder0 — Mon, 28 Sep 2020 10:20:04 GMT

What are some of the methods that I can remove the header row after running the 'outputcsv' command in my search?

Here are some of the fields in that header row:

CreateTimeStamp_GMT Data_Source Reference_Number SourceIP_Address Incident_Category

Re: Removing Header row after outputcsv command

itinney — Mon, 28 Sep 2020 10:20:12 GMT

If the header row is in an event of its own, then use a Transform to send it to the Null Queue.
Else If the header row is in a multi-line event, use SEDCMD to strip it out.

Option 1 is documented here: http://docs.splunk.com/Documentation/Splunk/4.3/Deploy/Routeandfilterdatad#Filter_event_data_and_send_to_queues

Option 2 is documented here:http://docs.splunk.com/Documentation/Splunk/4.3/Data/Anonymizedatausingconfigurationfiles#Through_a_sed_script

Oh sorry I notice that this is after using outputcsv! No you cannot do it.

Re: Removing Header row after outputcsv command

Rob — Thu, 19 Jan 2012 18:43:33 GMT

Pretty sure that there is no way to do this when the outputcsv command is called to generate the csv file with events from your search results. I would recommend using a script to clean up the CSV file after its been generated for which SED would be useful or using batch/cmd/powershell on Win systems.