topic Remove first line from event types in Splunk Search https://community.splunk.com/t5/Splunk-Search/Remove-first-line-from-event-types/m-p/34636#M178392 <P>How do i remove the first line from event type when importing a log file into our enviornment? I thought it would be CHECK_FOR_HEADER=true? Any suggestions?</P> Mon, 28 Sep 2020 12:15:53 GMT Michael_Schyma1 2020-09-28T12:15:53Z Remove first line from event types https://community.splunk.com/t5/Splunk-Search/Remove-first-line-from-event-types/m-p/34636#M178392 <P>How do i remove the first line from event type when importing a log file into our enviornment? I thought it would be CHECK_FOR_HEADER=true? Any suggestions?</P> Mon, 28 Sep 2020 12:15:53 GMT https://community.splunk.com/t5/Splunk-Search/Remove-first-line-from-event-types/m-p/34636#M178392 Michael_Schyma1 2020-09-28T12:15:53Z Re: Remove first line from event types https://community.splunk.com/t5/Splunk-Search/Remove-first-line-from-event-types/m-p/34637#M178393 <P>Use nullqueue:</P> <P><A href="http://splunk-base.splunk.com/answers/11617/route-unwanted-logs-to-a-null-queue">http://splunk-base.splunk.com/answers/11617/route-unwanted-logs-to-a-null-queue</A></P> Tue, 14 Aug 2012 15:50:57 GMT https://community.splunk.com/t5/Splunk-Search/Remove-first-line-from-event-types/m-p/34637#M178393 dmaislin_splunk 2012-08-14T15:50:57Z Re: Remove first line from event types https://community.splunk.com/t5/Splunk-Search/Remove-first-line-from-event-types/m-p/34638#M178394 <P><IMG src="http://splunk-base.splunk.com//storage/Props.png" alt="alt text" /></P> <P>IS there a way to do this in this screen.... (screenshot above)</P> Tue, 14 Aug 2012 16:17:44 GMT https://community.splunk.com/t5/Splunk-Search/Remove-first-line-from-event-types/m-p/34638#M178394 Michael_Schyma1 2012-08-14T16:17:44Z Re: Remove first line from event types https://community.splunk.com/t5/Splunk-Search/Remove-first-line-from-event-types/m-p/34639#M178395 <P>You'll need a setting in transforms.conf as well. This is a good reference in addition to the example in the docs.</P> <P><A href="http://splunk-base.splunk.com/answers/49366/how-to-ignore-first-three-line-of-my-log">http://splunk-base.splunk.com/answers/49366/how-to-ignore-first-three-line-of-my-log</A>.</P> Tue, 14 Aug 2012 17:55:55 GMT https://community.splunk.com/t5/Splunk-Search/Remove-first-line-from-event-types/m-p/34639#M178395 sdaniels 2012-08-14T17:55:55Z