Splunk Search

how to skip header file in csv

Gayathirikuppus
New Member

i have a csv file with header column"Name","CapacityGB","FreeSpaceGB" with the line number 1.

This header is also coming along with the next line as one single event:

I have used the below props.conf:

[xxxxx]
INDEXED_EXTRACTIONS = CSV
DATETIME_CONFIG = CURRENT
NO_BINARY_CHECK = true
SHOULD_LINEMERGE = true
MUST_BREAK_AFTER = (\,\"\d+.\d+\"$)
FIELD_DELIMITER=,
FIELD_QUOTE="

ISSUE:

1/27/19
4:31:01.000 AM

"Name","CapacityGB","FreeSpaceGB"
"xxxxxx","1008.374375","486.1959375"

Please let me know how to exclude the header file.

Do i have to update anything on props.conf?

Tags (1)
0 Karma

lakshman239
Influencer

you may want to add the following in your props.conf your sourcetype to try and exclude the header being added to events.

HEADER_FIELD_LINE_NUMBER=1
PREAMBLE_REGEX=^\"[a-zA-Z\,\"]+

0 Karma

dkeck
Influencer

Hi,

have a look at this, and make sure you set this on your forwarder.

https://answers.splunk.com/answers/586952/how-to-skip-header-in-csv-files-before-indexing.html

Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...