How do i remove the first line from event type when importing a log file into our enviornment? I thought it would be CHECK_FOR_HEADER=true? Any suggestions?
Use nullqueue:
http://splunk-base.splunk.com/answers/11617/route-unwanted-logs-to-a-null-queue
You'll need a setting in transforms.conf as well. This is a good reference in addition to the example in the docs.
http://splunk-base.splunk.com/answers/49366/how-to-ignore-first-three-line-of-my-log.
IS there a way to do this in this screen.... (screenshot above)
