All Apps and Add-ons

Splunk Add-on Builder: Why is my regular expression to remove first line of text file not working?

estrano_splunk
Splunk Employee
Splunk Employee

I used the Splunk Add-on Builder to export an add-on that I'm working on but I needed to make a tweak to props.conf and transforms.conf in order to remove the first line of multiple source types (text files) that I'm monitoring in inputs.conf. However, I am getting no results and am unsure why, these are my .conf stanzas.

[assignment_fact]
NO_BINARY_CHECK = true
category = Splunk App Add-on Builder
disabled = false
SHOULD_LINEMERGE = 0
pulldown_type = true
TRANSFORMS-removeheader = removeheaderrow
REPORT-ta_builder_internal_use_table_format_results_for_assignment_fact = ta_builder_internal_use_table_format_results_for_assignment_fact

[removeheaderrow]
REGEX = \A[^\n]*\n
DEST_KEY = queue
FORMAT = nullQueue
0 Karma

cpetterborg
SplunkTrust
SplunkTrust

You are sending the entire event to the nullQueue. If you want to just get rid of the first line of a multi-line event you have to do it differently.

Try something like:

[removeheaderrow]
REGEX = \A[^\n]*\n([\s\S]+)
FORMAT = $1
DEST_KEY = _raw
0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!