Splunk Search

how to skip header file in csv

Gayathirikuppus
New Member

i have a csv file with header column"Name","CapacityGB","FreeSpaceGB" with the line number 1.

This header is also coming along with the next line as one single event:

I have used the below props.conf:

[xxxxx]
INDEXED_EXTRACTIONS = CSV
DATETIME_CONFIG = CURRENT
NO_BINARY_CHECK = true
SHOULD_LINEMERGE = true
MUST_BREAK_AFTER = (\,\"\d+.\d+\"$)
FIELD_DELIMITER=,
FIELD_QUOTE="

ISSUE:

1/27/19
4:31:01.000 AM

"Name","CapacityGB","FreeSpaceGB"
"xxxxxx","1008.374375","486.1959375"

Please let me know how to exclude the header file.

Do i have to update anything on props.conf?

Tags (1)
0 Karma

lakshman239
SplunkTrust
SplunkTrust

you may want to add the following in your props.conf your sourcetype to try and exclude the header being added to events.

HEADER_FIELD_LINE_NUMBER=1
PREAMBLE_REGEX=^\"[a-zA-Z\,\"]+

0 Karma

dkeck
Influencer

Hi,

have a look at this, and make sure you set this on your forwarder.

https://answers.splunk.com/answers/586952/how-to-skip-header-in-csv-files-before-indexing.html

Get Updates on the Splunk Community!

Take the 2021 Splunk Career Survey for $50 in Amazon Cash

Help us learn about how Splunk has impacted your career by taking the 2021 Splunk Career Survey. Last year’s ...

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...

Observability Newsletter Highlights | March 2023

 March 2023 | Check out the latest and greatestSplunk APM's New Tag Filter ExperienceSplunk APM has updated ...