How do I tell Splunk not to ignore first line in structured psv file?

[Woody35]

I have log files that append new data every five minutes starting with a timestamp, then dashes (-) then header, then dashes, then many events, and concludes with  dashes.  Splunk is not seeing the first timestamp in the file, but when it hits the timestamp 10 rows in, and subsequent ones, it picks up the timestamp and applies it to all events until it hits another timestamp.  Using universal forwarder on version 8.

2020-12-15 22:03:36,877 INFO [Timer-Driven Process Thread-3] o.a.n.c.C.Processors Processor Statuses:
------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
| Processor Name | Processor ID | Processor Type | Run Status | Flow Files In | Flow Files Out | Bytes Read | Bytes Written | Tasks | Proc Time |
------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
| Put file in HDFS | 857c16a7-5bf0-31e5-bd30-fa66d414d6af | PutHDFS | Disabled | 0 / 0 bytes (+0/+0 bytes) | 0 / 0 bytes (+0/+0 bytes) | 0 bytes (+0 bytes) | 0 bytes (+0 bytes) | 0 (+0) | 00:00:00.000 (+00:00:00.000) |
| Update filename to keytab name | 34a833ad-8002-3e9b-8418-41191fc1f460 | UpdateAttribute | Disabled | 0 / 0 bytes (+0/+0 bytes) | 0 / 0 bytes (+0/+0 bytes) | 0 bytes (+0 bytes) | 0 bytes (+0 bytes) | 0 (+0) | 00:00:00.000 (+00:00:00.000) |
| Extract username and hdfslocat | 61173591-acac-3706-95b2-d7abf5da3396 | EvaluateJsonPath | Disabled | 0 / 0 bytes (+0/+0 bytes) | 0 / 0 bytes (+0/+0 bytes) | 0 bytes (+0 bytes) | 0 bytes (+0 bytes) | 0 (+0) | 00:00:00.000 (+00:00:00.000) |
| Fetch local keytab File | 06e85e30-73a7-30e3-a696-3a992f6f96ce | FetchFile | Disabled | 0 / 0 bytes (+0/+0 bytes) | 0 / 0 bytes (+0/+0 bytes) | 0 bytes (+0 bytes) | 0 bytes (+0 bytes) | 0 (+0) | 00:00:00.000 (+00:00:00.000) |
------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
2020-12-15 22:08:37,154 INFO [Timer-Driven Process Thread-3] o.a.n.c.C.Processors Processor Statuses:
------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
| Processor Name | Processor ID | Processor Type | Run Status | Flow Files In | Flow Files Out | Bytes Read | Bytes Written | Tasks | Proc Time |
------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
| HandleHttpRequest | 63363733-77c0-16b6-b519-2a4a3d2e2530 | HandleHttpRequest | Running | 0 / 0 bytes (+0/+0 bytes) | 0 / 0 bytes (+0/+0 bytes) | 0 bytes (+0 bytes) | 0 bytes (+0 bytes) | 103357 (+10335 | 00:04:09.863 (+00:04:09.863) |
| :64096 PUT, POST newForm, subm | faca87ea-0617-3cbc-b64c-d83f0420c5db | HandleHttpRequest | Running | 0 / 0 bytes (+0/+0 bytes) | 0 / 0 bytes (+0/+0 bytes) | 0 bytes (+0 bytes) | 0 bytes (+0 bytes) | 103274 (+10327 | 00:04:07.390 (+00:04:07.390) |
| Run netstat command q40 | fe76dc61-46c0-3dec-8e38-edcb7c192197 | ExecuteProcess | Running | 0 / 0 bytes (+0/+0 bytes) | 5 / 10 bytes (+5/+10 bytes) | 0 bytes (+0 bytes) | 10 bytes (+10 bytes) | 5 (+5) | 00:00:00.802 (+00:00:00.802) |
| Run netstat command q30 | ce56f2d4-c74e-3bd2-9474-1ed0b67adeeb | ExecuteProcess | Running | 0 / 0 bytes (+0/+0 bytes) | 5 / 10 bytes (+5/+10 bytes) | 0 bytes (+0 bytes) | 10 bytes (+10 bytes) | 5 (+5) | 00:00:00.801 (+00:00:00.801) |
| Send to Ambari Metrics Collect | 9f953e4a-e292-3483-ae8c-cc826f60a46e | InvokeHTTP | Running | 10 / 2.33 KB (+10/+2.33 KB) | 0 / 0 bytes (+0/+0 bytes) | 0 bytes (+0 bytes) | 130 bytes (+130 bytes) | 10 (+10) | 00:00:00.374 (+00:00:00.374) |
| ExtractText | 2d705770-c331-33ba-a0f2-b761284be861 | ExtractText | Running | 10 / 20 bytes (+10/+20 bytes) | 10 / 20 bytes (+10/+20 bytes) | 20 bytes (+20 bytes) | 0 bytes (+0 bytes) | 10 (+10) | 00:00:00.107 (+00:00:00.107) |
------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

[to4kawa]

props.conf at your indexer.

[ your_sourcetype ]
SHOULD_LINEMERGE=false
LINE_BREAKER=([\r\n]+)\d{4}-
NO_BINARY_CHECK=true
SEDCMD-trim=s/(?ms)-{8,}//g s/(?ms)^.*Proc Time \|\s+//

[Woody35]

This solution did not solve the problem.  Only the first instance of the timestamp is missed.  Otherwise the out-of-the-box .psv works well.

[to4kawa]

sample:

sourcetype="psv_trim" 
| table _time Processor_Name , Processor_ID , Processor_Type , Run_Status , Flow_Files_In , Flow_Files_Out , Bytes_Read , Bytes_Written , Tasks , Proc_Time
| eval range=mvrange(0,mvcount(Processor_Name))
| mvexpand range
| rename range as _range
| foreach * [eval <<FIELD>> = mvindex('<<FIELD>>' , _range ) ]

Please make  transforms.conf with my props.conf.
I think your method can't extract _time appropriately.