Remove first line from event types

[Michael_Schyma1]

How do i remove the first line from event type when importing a log file into our enviornment? I thought it would be CHECK_FOR_HEADER=true? Any suggestions?

[dmaislin_splunk]

Use nullqueue:

http://splunk-base.splunk.com/answers/11617/route-unwanted-logs-to-a-null-queue

[sdaniels]

You'll need a setting in transforms.conf as well. This is a good reference in addition to the example in the docs.

http://splunk-base.splunk.com/answers/49366/how-to-ignore-first-three-line-of-my-log.

[Michael_Schyma1]

IS there a way to do this in this screen.... (screenshot above)