Removing Header row after outputcsv command

[efelder0]

What are some of the methods that I can remove the header row after running the 'outputcsv' command in my search?

Here are some of the fields in that header row:

CreateTimeStampGMT DataSource ReferenceNumber SourceIPAddress Incident_Category

[itinney · Accepted solution]

1. If the header row is in an event of its own, then use a Transform to send it to the Null Queue.
2. Else If the header row is in a multi-line event, use SEDCMD to strip it out.

Option 1 is documented here: http://docs.splunk.com/Documentation/Splunk/4.3/Deploy/Routeandfilterdatad#Filtereventdataandsendtoqueues

Option 2 is documented here:http://docs.splunk.com/Documentation/Splunk/4.3/Data/Anonymizedatausingconfigurationfiles#Throughased_script

---

Oh sorry I notice that this is after using outputcsv! No you cannot do it.

[Rob]

Pretty sure that there is no way to do this when the outputcsv command is called to generate the csv file with events from your search results. I would recommend using a script to clean up the CSV file after its been generated for which SED would be useful or using batch/cmd/powershell on Win systems.