How to skip reading CVS heard from server where Splunk Universal Forwarder is installed

[mlevsh]

Hi,

On server with Splunk Universal Forwarder installed we are monitoring cvs log with a header and lines in the following format:

"Status","Device Name","IP Address","Site","Last Backup Date"
"Success","Active Directory","10.123.456.78","Global","30-04-2020 20:11:05" 
"Failure","Active Directory","10.123.456.89","Global","30-04-2020 20:11:06" 

Splunk ingests "Header" line even with the following header related parameters in the props.conf:

[cvs_custom_sourcetype]
   DATETIME_CONFIG = CURRENT
   SHOULD_LINEMERGE = false
   LINE_BREAKER = ([\r\n]+)
   NO_BINARY_CHECK = true
   INDEXED_EXTRACTIONS = csv
   HEADER_FIELD_LINE_NUMBER = 1
   HEADER_FIELD_DELIMITER = ,
   HEADER_FIELD_QUOTE = "
   FIELD_QUOTE = "
   KV_MODE = none

Any suggestions why it is happening?