Getting Data In

Windows UF ignores CSV header until restart

_smp_
Builder

I have a simple CSV file input on a Windows UF with a header of field names in the top row. The file is overwritten daily with the same name. When I delete the file and restart Splunk, the header row is ignored as expected. But if the UF (v8.0.5) is restarted, the header row will start being indexed. This will continue until I delete the file and restart the Splunk process, when it will begin ignoring the header row again (until the Splunk process is restarted).

My goal is to always ignore the first line of the file, regardless of whether the Splunk process is restarted.

Here is the current iteration of our props.conf. I'm not locked into this config, but I've tried many different combinations and can't seem to find the right one. Any suggestions on what to tweak?

 

[crowdstrike:metrics:cicoverage]
SHOULD_LINEMERGE = false
LINE_BREAKER = ([\r\n]+)
CHARSET = UTF-8
INDEXED_EXTRACTIONS = csv
KV_MODE = none
disabled = false
HEADER_FIELD_LINE_NUMBER = 1
TZ = UTC
CHECK_FOR_HEADER = true

 

 

Labels (3)
0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!