topic Re: ignoring the first row (column headers) in a CSV data source in Getting Data In

ignoring the first row (column headers) in a CSV data source

jgautreau — Mon, 18 Nov 2013 17:41:23 GMT

Hi,
When i input data from files & directories in splunk, is there a way to ignore the first row (column headers) in a CSV data source?

Thanks, John

lukejadamec — Mon, 18 Nov 2013 17:44:49 GMT

Can you post an example of the header row?

lukejadamec — Mon, 18 Nov 2013 17:49:35 GMT

You can use props.conf and transforms.conf to remove the header rows.

For example, if your header row starts with a # character, then the configuration would look like this:

Create these configs on the indexer.

Props.conf

[sourcetype]
TRANSFORMS-removeheader = removeheaderrow

Transforms.conf

[removeheaderrow]
REGEX = ^\#.*
DEST_KEY = queue
FORMAT = nullQueue

jgautreau — Mon, 18 Nov 2013 18:40:05 GMT

Ah - i see how Props.conf can be configured when but how to i update the associated Transforms.conf file?

thanks! John

lukejadamec — Mon, 18 Nov 2013 18:43:39 GMT

Is the header row always the same? If so, then just create a regex that matches, and put that in the code I posted in the answer.