ignoring the first row (column headers) in a CSV data source

[jgautreau]

Hi,
When i input data from files & directories in splunk, is there a way to ignore the first row (column headers) in a CSV data source?

Thanks, John

[lukejadamec]

Is the header row always the same? If so, then just create a regex that matches, and put that in the code I posted in the answer.

[jgautreau]

Ah - i see how Props.conf can be configured when but how to i update the associated Transforms.conf file?

thanks! John

[lukejadamec]

You can use props.conf and transforms.conf to remove the header rows.

For example, if your header row starts with a # character, then the configuration would look like this:

Create these configs on the indexer.

Props.conf

[sourcetype]
TRANSFORMS-removeheader = removeheaderrow

Transforms.conf

[removeheaderrow]
REGEX = ^\#.*
DEST_KEY = queue
FORMAT = nullQueue

[lukejadamec]

Can you post an example of the header row?