Getting Data In

Remove Header column outputcsv

efelder0
Communicator

Is there a way to remove the Header column row after performing the outputcsv command during a Splunk search?

1 Solution

Rob
Splunk Employee
Splunk Employee

I don't thing there is any way to remove the header by using a Splunk command that would remove it from the csv file generated by the outputcsv command. Your best bet would be to run a clean up script that removes the header info after the file is generated.

View solution in original post

0 Karma

Rob
Splunk Employee
Splunk Employee

I don't thing there is any way to remove the header by using a Splunk command that would remove it from the csv file generated by the outputcsv command. Your best bet would be to run a clean up script that removes the header info after the file is generated.

0 Karma

responsys_cm
Builder

Can we get this feature added as an option to the outputcsv command? I have some tools that use CSV files for configs and it would be nice if Splunk could keep them dynamically updated.

0 Karma

Starlette
Contributor

2 options :

1)
Save a NOT search as macro to catch the lines and prefix this in your main search

2)
Get rid of them before indexing ( best option)

Check this , and scroll for the sedcmd

The regex should be pretty easy,,just the first range of characters, let me know if you succeed, otherwise paste a sample and the header...

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...