topic Re: Removing CSV Header from Indexing in Getting Data In

Removing CSV Header from Indexing

srsava — Mon, 18 Jul 2011 19:40:23 GMT

Hello Splunk Community,

I uploaded custom CSV files to Splunk for indexing. The CSV Header for each file is being indexed with a time stamp for the day the file is uploaded. I do not want the CSV Header returned in the results. I have looked through the answer.splunk knowledge base and attempted to configure the props.conf and transforms.conf as suggested by other users. I am not achieving the results I desire. I am still indexing the CSV Header as an event when the Header should just be ignored.

My Headers include Number, Date Time, Service, Source Port, Source, Destination, Protocol

Please help if possible.

Re: Removing CSV Header from Indexing

RicoSuave — Mon, 18 Jul 2011 20:44:30 GMT

I have run into the same issue. I just end up deleting that particular event. Click on the event to isolate it in the results, then just pipe it to delete:

| delete

Make sure you have the can delete role or else it wont work.

Re: Removing CSV Header from Indexing

srsava — Tue, 19 Jul 2011 20:58:08 GMT

Thanks for your help, Although this WILL remove the Header after it is indexed, I have hundreds of CSV files I am collecting and will be indexing for this project. Can someone explain the method to remove the CSV header from being published as an event? Why does splunk assign a datetime to the CSV header?...based off the datetime the file was created? I would like to configure the Splunk instance to monitor a file location for any changes and NOT publish the CSV header as an event. I do not want to have to delete each CSV Header instance as they are indexed or perhaps re-indexed.

Re: Removing CSV Header from Indexing

mikelanghorst — Wed, 20 Jul 2011 14:51:14 GMT

You can simply null-queue the event with the header. Look for the section titled: "Filter event data and send to queues" here in the docs
http://www.splunk.com/base/Documentation/4.2.2/Deploy/Routeandfilterdatad

Re: Removing CSV Header from Indexing

fk319 — Thu, 21 Jul 2011 20:19:13 GMT

How are you importin your CSV files, inputcsv ?

There is an option start=<int> that starts importing after <int> lines.