Splunk Search

how to skip header file in csv

Gayathirikuppus
New Member

i have a csv file with header column"Name","CapacityGB","FreeSpaceGB" with the line number 1.

This header is also coming along with the next line as one single event:

I have used the below props.conf:

[xxxxx]
INDEXED_EXTRACTIONS = CSV
DATETIME_CONFIG = CURRENT
NO_BINARY_CHECK = true
SHOULD_LINEMERGE = true
MUST_BREAK_AFTER = (\,\"\d+.\d+\"$)
FIELD_DELIMITER=,
FIELD_QUOTE="

ISSUE:

1/27/19
4:31:01.000 AM

"Name","CapacityGB","FreeSpaceGB"
"xxxxxx","1008.374375","486.1959375"

Please let me know how to exclude the header file.

Do i have to update anything on props.conf?

Tags (1)
0 Karma

lakshman239
Influencer

you may want to add the following in your props.conf your sourcetype to try and exclude the header being added to events.

HEADER_FIELD_LINE_NUMBER=1
PREAMBLE_REGEX=^\"[a-zA-Z\,\"]+

0 Karma

dkeck
Influencer

Hi,

have a look at this, and make sure you set this on your forwarder.

https://answers.splunk.com/answers/586952/how-to-skip-header-in-csv-files-before-indexing.html

Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...