Splunk Search

how to skip header file in csv

Gayathirikuppus
New Member

i have a csv file with header column"Name","CapacityGB","FreeSpaceGB" with the line number 1.

This header is also coming along with the next line as one single event:

I have used the below props.conf:

[xxxxx]
INDEXED_EXTRACTIONS = CSV
DATETIME_CONFIG = CURRENT
NO_BINARY_CHECK = true
SHOULD_LINEMERGE = true
MUST_BREAK_AFTER = (\,\"\d+.\d+\"$)
FIELD_DELIMITER=,
FIELD_QUOTE="

ISSUE:

1/27/19
4:31:01.000 AM

"Name","CapacityGB","FreeSpaceGB"
"xxxxxx","1008.374375","486.1959375"

Please let me know how to exclude the header file.

Do i have to update anything on props.conf?

Tags (1)
0 Karma

lakshman239
Influencer

you may want to add the following in your props.conf your sourcetype to try and exclude the header being added to events.

HEADER_FIELD_LINE_NUMBER=1
PREAMBLE_REGEX=^\"[a-zA-Z\,\"]+

0 Karma

dkeck
Influencer

Hi,

have a look at this, and make sure you set this on your forwarder.

https://answers.splunk.com/answers/586952/how-to-skip-header-in-csv-files-before-indexing.html

Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...