I have a simple CSV file input on a Windows UF with a header of field names in the top row. The file is overwritten daily with the same name. When I delete the file and restart Splunk, the header row is ignored as expected. But if the UF (v8.0.5) is restarted, the header row will start being indexed. This will continue until I delete the file and restart the Splunk process, when it will begin ignoring the header row again (until the Splunk process is restarted).
My goal is to always ignore the first line of the file, regardless of whether the Splunk process is restarted.
Here is the current iteration of our props.conf. I'm not locked into this config, but I've tried many different combinations and can't seem to find the right one. Any suggestions on what to tweak?
[crowdstrike:metrics:cicoverage]
SHOULD_LINEMERGE = false
LINE_BREAKER = ([\r\n]+)
CHARSET = UTF-8
INDEXED_EXTRACTIONS = csv
KV_MODE = none
disabled = false
HEADER_FIELD_LINE_NUMBER = 1
TZ = UTC
CHECK_FOR_HEADER = true
