Try this: http://docs.splunk.com/Documentation/Splunk/latest/Data/Extractfieldsfromfileheadersatindextime In inputs.conf [monitor:///your-path/filename] sourcetype=header-file In props.conf [header-file] FIELD_DELIMITER=space HEADER_FIELD_DELIMITER=space HEADER_FIELD_LINE_NUMBER=20 NO_BINARY_CHECK=1 SHOULD_LINEMERGE=false Should dump the first 19 lines (the garbage) and use the header found in line 20. If the header is variable length, you can use other methods such as FIELD_HEADER_REGEX. Note this will work on Forwarders and does the header/field mapping at index-time. ... View more