https://community.splunk.com/t5/Getting-Data-In/Ignore-first-line/m-p/85826#M17841 <P>Take a look at this question, which is quite close to yours.</P> <P><A href="http://splunk-base.splunk.com/answers/1041/how-to-ignore-the-titile-line-of-the-csv-file-in-the-result-and-display-in-a-kv-format">How to ignore the title line of the csv file in the result and display in a kv format</A></P> <P>I don't think that the <CODE>CHECK_FOR_HEADER = true</CODE> suggestion will work, but the solution that uses a TRANSFORM will.</P> Wed, 07 Mar 2012 22:01:05 GMT lguinn2 2012-03-07T22:01:05Z https://community.splunk.com/t5/Getting-Data-In/Ignore-first-line/m-p/85823#M17838 <P>Hi,<BR /> I am importing custom CSV files. The heading are are the first line. What is the simplest way to ignore these headings? Which files to I need to edit?</P> Tue, 06 Mar 2012 16:28:36 GMT https://community.splunk.com/t5/Getting-Data-In/Ignore-first-line/m-p/85823#M17838 aleem 2012-03-06T16:28:36Z https://community.splunk.com/t5/Getting-Data-In/Ignore-first-line/m-p/85824#M17839 <P>If you tell Splunk that the sourcetype of the file is "csv", I believe Splunk will take care of that for you, as well as extracting the fields.</P> Tue, 06 Mar 2012 16:34:15 GMT https://community.splunk.com/t5/Getting-Data-In/Ignore-first-line/m-p/85824#M17839 lguinn2 2012-03-06T16:34:15Z https://community.splunk.com/t5/Getting-Data-In/Ignore-first-line/m-p/85825#M17840 <P>Thanks, I tried that. Splunk recognises sourcetype as csv-2 and still indexes the headings</P> Tue, 06 Mar 2012 17:00:15 GMT https://community.splunk.com/t5/Getting-Data-In/Ignore-first-line/m-p/85825#M17840 aleem 2012-03-06T17:00:15Z https://community.splunk.com/t5/Getting-Data-In/Ignore-first-line/m-p/85826#M17841 <P>Take a look at this question, which is quite close to yours.</P> <P><A href="http://splunk-base.splunk.com/answers/1041/how-to-ignore-the-titile-line-of-the-csv-file-in-the-result-and-display-in-a-kv-format">How to ignore the title line of the csv file in the result and display in a kv format</A></P> <P>I don't think that the <CODE>CHECK_FOR_HEADER = true</CODE> suggestion will work, but the solution that uses a TRANSFORM will.</P> Wed, 07 Mar 2012 22:01:05 GMT https://community.splunk.com/t5/Getting-Data-In/Ignore-first-line/m-p/85826#M17841 lguinn2 2012-03-07T22:01:05Z