Hello, I'm trying to import this kind of file : \#DATE TITRE1 TITRE2 TITRE3 #LINE TO IGNORE 20170101 LIGNE1COL1 LIGNE1COL2 "LIGNE1 COL 3" 20170101 LIGNE2COL1 LIGNE2COL2 "LIGNE2 COL 3" 20170101 LIGNE3COL1 LIGNE3COL2 "LIGNE3 COL 3" 20170101 LIGNE1COL1 LIGNE1COL2 "LIGNE1 COL 3" 20170101 LIGNE2COL1 LIGNE2COL2 "LIGNE2 COL 3" 20170101 LIGNE3COL1 LIGNE3COL2 "LIGNE3 COL 3" 20170101 LIGNE1COL1 LIGNE1COL2 "LIGNE1 COL 3" 20170101 LIGNE2COL1 LIGNE2COL2 "LIGNE2 COL 3" 20170101 LIGNE3COL1 LIGNE3COL2 "LIGNE3 COL 3" 20170101 LIGNE1COL1 LIGNE1COL2 "LIGNE1 COL 3" 20170101 LIGNE2COL1 LIGNE2COL2 "LIGNE2 COL 3" Please take take of two space between the date and the second column in the "values" oart and only one space in the "header" part. Titles are in the first line. I don't want the second line to be read. So, I defined a new source type with spaces as separator. I ignore lines starting with character # and I say fields names are on the first line. The problem is that Splunk defines a new field named "EXTRA_FIELD_5" with values from the last column ("LIGNE1 COL 3"). The field TITRE2 has values of the second column (LIGNE1COL1) and the field TITRE3 has values like LIGNE1COL2. If I replace the two spaces into only one space, the values are loaded in the right way except the second line which is read whatever i set up. So I tried to use transformation to transform two spaces in one space but this doesn't work. Here is the rules : [source::\*mycompany\*.log] #SEDCMD-single-whitespace = s/ / /g #SEDCMD-remove-line = s/#LINE TO IGNORE\n// I am not sure I'm using the right props.conf (Splunk\etc\users\admin\search\local\props.conf, Splunk\etc\apps\search\default\props.conf or Splunk\etc\system\default\props.conf). I don't understand why the second line is not ignored. I googled the problem and saw some answer talking about HEADER_FIELD_LINE_NUMBER = 1 and PREAMBLE_REGEX = ^#.* This doesn't work. I think my syntax is correct because this search works : source="\*mycompany\*.log" | rex field=DATE mode=sed "s/2017/2018/g" I'm using Splunk Light Free Version 6.4.1 So please help me to understand what is wrong and how to solve my problem. Regards Stephane ... View more