Getting Data In

How to remove the header line from the log file so that data should be indexed without the header.


Below is my log file, i need to send log to my index without the header name and with only the values with there respective field name by using props.conf file

CHG0057654~^~9/10/2020 4:45:00 PM~^~9/10/2020 5:45:00 PM~^~Linux~^~BASF Linux Patching testing

can anyone tell us how to write props.conf file

Labels (1)
0 Karma

Tune In & Win!

Don't miss out on your
chance to take home free
prizes by helping our players
save the Splunk Cloudom!

Dungeons & Data
Monsters: Splunk O11y
Day Editions Games
stream live:
5/4 at 6:30pm PST
5/5 at 7:00pm PST