https://community.splunk.com/t5/Getting-Data-In/Input-First-Line-of-File/m-p/82473#M17080 <P>I have the requirement of inputing only the first line of a file. The first line is of interest then the rest of the file is not needed. The file will be rewritten with new values and again I require just to input the first line of the file.</P> <P>Is there a way to just take in the first line and then dump the rest of the file each time Splunk looks at the file?</P> Fri, 04 Oct 2013 04:46:47 GMT cdobie 2013-10-04T04:46:47Z https://community.splunk.com/t5/Getting-Data-In/Input-First-Line-of-File/m-p/82473#M17080 <P>I have the requirement of inputing only the first line of a file. The first line is of interest then the rest of the file is not needed. The file will be rewritten with new values and again I require just to input the first line of the file.</P> <P>Is there a way to just take in the first line and then dump the rest of the file each time Splunk looks at the file?</P> Fri, 04 Oct 2013 04:46:47 GMT https://community.splunk.com/t5/Getting-Data-In/Input-First-Line-of-File/m-p/82473#M17080 cdobie 2013-10-04T04:46:47Z https://community.splunk.com/t5/Getting-Data-In/Input-First-Line-of-File/m-p/82474#M17081 <P>Nope, not easily with the regular file monitor. If you can identify the data you want through some sort of pattern you can setup rules for throwing all the other events (see <A href="http://docs.splunk.com/Documentation/Splunk/6.0/Forwarding/Routeandfilterdatad">http://docs.splunk.com/Documentation/Splunk/6.0/Forwarding/Routeandfilterdatad</A> ). Otherwise your best bet is to setup a scripted input so you can put your case-specific logic in the script that you use for retrieving the events.</P> Fri, 04 Oct 2013 06:16:00 GMT https://community.splunk.com/t5/Getting-Data-In/Input-First-Line-of-File/m-p/82474#M17081 Ayn 2013-10-04T06:16:00Z