Getting Data In

Removing Header row after outputcsv command

efelder0
Communicator

What are some of the methods that I can remove the header row after running the 'outputcsv' command in my search?

Here are some of the fields in that header row:

CreateTimeStamp_GMT Data_Source Reference_Number SourceIP_Address Incident_Category

Tags (1)
1 Solution

itinney
Path Finder
  1. If the header row is in an event of its own, then use a Transform to send it to the Null Queue.
  2. Else If the header row is in a multi-line event, use SEDCMD to strip it out.

Option 1 is documented here: http://docs.splunk.com/Documentation/Splunk/4.3/Deploy/Routeandfilterdatad#Filter_event_data_and_sen...

Option 2 is documented here:http://docs.splunk.com/Documentation/Splunk/4.3/Data/Anonymizedatausingconfigurationfiles#Through_a_...


Oh sorry I notice that this is after using outputcsv! No you cannot do it.

View solution in original post

Rob
Splunk Employee
Splunk Employee

Pretty sure that there is no way to do this when the outputcsv command is called to generate the csv file with events from your search results. I would recommend using a script to clean up the CSV file after its been generated for which SED would be useful or using batch/cmd/powershell on Win systems.

itinney
Path Finder
  1. If the header row is in an event of its own, then use a Transform to send it to the Null Queue.
  2. Else If the header row is in a multi-line event, use SEDCMD to strip it out.

Option 1 is documented here: http://docs.splunk.com/Documentation/Splunk/4.3/Deploy/Routeandfilterdatad#Filter_event_data_and_sen...

Option 2 is documented here:http://docs.splunk.com/Documentation/Splunk/4.3/Data/Anonymizedatausingconfigurationfiles#Through_a_...


Oh sorry I notice that this is after using outputcsv! No you cannot do it.

Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...