Hi, I am importing custom CSV files. The heading are are the first line. What is the simplest way to ignore these headings? Which files to I need to edit?
Take a look at this question, which is quite close to yours.
How to ignore the title line of the csv file in the result and display in a kv format
I don't think that the CHECK_FOR_HEADER = true suggestion will work, but the solution that uses a TRANSFORM will.
CHECK_FOR_HEADER = true
If you tell Splunk that the sourcetype of the file is "csv", I believe Splunk will take care of that for you, as well as extracting the fields.
Thanks, I tried that. Splunk recognises sourcetype as csv-2 and still indexes the headings
