Getting Data In

how to remove headings of a log file?

SapthagiriAavik
Explorer

i indexed my log file line by line using regex, i want only valid rows not headings and lines , but in my query results those headings and lines are included. How to omit those in results?

my log file sample

SNAP_TIME app Sector MEMBER NO_HANDLE PRIVATE_SORT


2018-02-02-04.16 SC_SAS_QV MINOR_SC 36 17160 48576
2018-02-02-04.16 SC_COGNOS MINOR_SC 3056 18220 256
2 record(s) selected.

query:
index=XXX source=XXX|rename app as APP_HAN Sector as File_D MEMBER as REGIME|table APP_HAN File_D REGIME

Actual Result:
APP_HAN File_D REGIME

APP Sector Member


SC_SAS_QV MINOR_SC 36
SC_COGNOS MINOR_SC 3056

Tags (1)
0 Karma

p_gurav
Champion

You can try adding HEADER_FIELD_LINE_NUMBER OR FIELD_HEADER_REGEX in props.conf:

0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Wednesday, May 29, 2024  |  11AM PST / 2PM ESTRegister now and join us to learn more about how you can ...

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer Certification at ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...