Input First Line of File

[cdobie]

I have the requirement of inputing only the first line of a file. The first line is of interest then the rest of the file is not needed. The file will be rewritten with new values and again I require just to input the first line of the file.

Is there a way to just take in the first line and then dump the rest of the file each time Splunk looks at the file?

[Ayn]

Nope, not easily with the regular file monitor. If you can identify the data you want through some sort of pattern you can setup rules for throwing all the other events (see http://docs.splunk.com/Documentation/Splunk/6.0/Forwarding/Routeandfilterdatad ). Otherwise your best bet is to setup a scripted input so you can put your case-specific logic in the script that you use for retrieving the events.