topic Remove Header column outputcsv in Getting Data In

Remove Header column outputcsv

efelder0 — Fri, 04 Nov 2011 15:17:55 GMT

Is there a way to remove the Header column row after performing the outputcsv command during a Splunk search?

Re: Remove Header column outputcsv

Starlette — Sun, 13 Nov 2011 16:01:54 GMT

2 options :

1)
Save a NOT search as macro to catch the lines and prefix this in your main search

2)
Get rid of them before indexing ( best option)

Check this , and scroll for the sedcmd

The regex should be pretty easy,,just the first range of characters, let me know if you succeed, otherwise paste a sample and the header...

Re: Remove Header column outputcsv

Rob — Thu, 19 Jan 2012 18:27:13 GMT

I don't thing there is any way to remove the header by using a Splunk command that would remove it from the csv file generated by the outputcsv command. Your best bet would be to run a clean up script that removes the header info after the file is generated.

Re: Remove Header column outputcsv

responsys_cm — Thu, 05 Jul 2012 22:54:59 GMT

Can we get this feature added as an option to the outputcsv command? I have some tools that use CSV files for configs and it would be nice if Splunk could keep them dynamically updated.