How to skip reading CVS heard from server where Splunk Universal Forwarder is installed

mlevsh — Wed, 13 May 2020 15:45:29 GMT

Hi,

On server with Splunk Universal Forwarder installed we are monitoring cvs log with a header and lines in the following format:

"Status","Device Name","IP Address","Site","Last Backup Date"
"Success","Active Directory","10.123.456.78","Global","30-04-2020 20:11:05" 
"Failure","Active Directory","10.123.456.89","Global","30-04-2020 20:11:06"

Splunk ingests "Header" line even with the following header related parameters in the props.conf:

[cvs_custom_sourcetype]
   DATETIME_CONFIG = CURRENT
   SHOULD_LINEMERGE = false
   LINE_BREAKER = ([\r\n]+)
   NO_BINARY_CHECK = true
   INDEXED_EXTRACTIONS = csv
   HEADER_FIELD_LINE_NUMBER = 1
   HEADER_FIELD_DELIMITER = ,
   HEADER_FIELD_QUOTE = "
   FIELD_QUOTE = "
   KV_MODE = none

Any suggestions why it is happening?

topic How to skip reading CVS heard from server where Splunk Universal Forwarder is installed in Getting Data In

How to skip reading CVS heard from server where Splunk Universal Forwarder is installed