- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Remove the first line of CSV to index in splunk
![Mayanakhan Mayanakhan](https://community.splunk.com/legacyfs/online/avatars/512855.jpg)
Mayanakhan
Explorer
10-28-2020
09:00 AM
I have a CSV file which first row contains the hear fields and remaining rows contains values as below.
name,application,targeturl,type
ABC,Desktop,google.com,chrome
XYZ,IOS,facebook.com,App
GHI,Andriod,twitter.com,App
KLM,Desktop,gmail.com,firefox
I have added props.conf as below.
[pp_appeaser]
CHARSET=UTF-8
INDEXED_EXTRACTIONS=csv
HEADER_FIELD_ACCEPTABLE_SPECIAL_CHARACTERS=_
KV_MODE=none
NO_BINARY_CHECK=true
SHOULD_LINEMERGE=false
category=Structured
description=Comma-separated value format. Set header and other settings in "Delimited Settings"
disabled=false
pulldown_type=true
In search the header fields are getting as fields and as well as values as below. also i have tried CHECK_FOR_HEADER" and "HEADER_FIELD_LINE_NUMBER=1" stanzas but i have same results.
Can you please suggest how can i resolve this issue, so the name of headers should not index as values.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
![Azeemering Azeemering](https://community.splunk.com/legacyfs/online/avatars/407394.jpg)
Azeemering
Builder
11-02-2020
10:08 AM
HEADER_FIELD_LINE_NUMBER=2 ?
![](/skins/images/53C7C94B4DD15F7CACC6D77B9B4D55BF/responsive_peak/images/icon_anonymous_message.png)