how to ignore the titile line of the csv file in the result? and display in a KV format?

I try to add some csv files, which contain data like the followings

Time, ACTION,ORDER_NO, ...

2009-11-2 20:00:00.041,REQUEST,48613840, ...

2009-11-2 20:00:00.041,REQUEST,48613839, ...

2009-11-2 20:00:00.041,REQUEST_ACK,48613840, ...

2009-11-2 20:00:00.041,REQUEST_ACK,48613839, ...

2009-11-2 20:00:00.046,REQUEST,48613841, ...

when I set the input source type as "csv", then the input file can be recognized with an "AutoHeader-1" stanza and a "csv-2" stanza being added to "$Splunk\etc\apps\learned\local\transforms.conf" and "$Splunk\etc\apps\learned\local\props.conf" respectively.

But I still have two problem,

the first line (title line "Time, ACTION,ORDER_NO, ...") will be take as an event also, as follows

10-4-5 02:49:28.000 _time,ACTION,ORDER_NO, ...

2009-11-2 20:00:00.074,REQUEST,48613844, ...

2009-11-2 20:00:00.055,REQUEST_ACK,48613842, ...

so, how can I remove the title line from the result?
How can I display the result in an KV format?

asked 05 Apr '10, 07:42

William
90●8
accept rate: 75%

edited 05 Apr '10, 15:46

gkanapathy ♦
26.2k●1●6●22

4 Answers:

oldest newest most voted

1	You can add the CHECK_FOR_HEADER = true on the props.conf. link answered 05 Apr '10, 13:33 BunnyHop 725●4●4●23 accept rate: 25% thanks, it works for the 2nd question. (07 Apr '10, 13:42) William

in your props.conf also add this line:

[yoursourcetype]
TRANSFORMS-NoHeader = NoHeader

on your transforms.conf add this:

[NoHeader]
REGEX = Time, ACTION,ORDER_NO, ...
DEST_KEY = queue
FORMAT = nullQueue

link

answered 07 Apr '10, 14:32

BunnyHop
725●4●4●23
accept rate: 25%

edited 20 Apr '10, 20:26

I would just leave it there and ignore it/exclude it in your searches, but if you really really want to, you can apply a regex TRANSFORM to strip it out.
Probably would be better if you were more specific about what you are trying to show/find. Splunk can transform results, but it's probably not very useful to simply rewrite the raw event text in a different format. What are you trying do or show with the data itself?

link

answered 05 Apr '10, 15:49

gkanapathy ♦
26.2k●1●6●22
accept rate: 42%

Seriously folks, the solution in answer <1> should be the default behaviour. Why would you want the headers included in your indexed data???

link

answered 28 Jul '10, 05:51

cmeo
130●7
accept rate: 0%

Do you really want Splunk choosing (own its own) to just drop certain events out of your log files?

(02 Aug '11, 10:43) Lowell ♦

Post your answer

toggle preview

Follow this question

Email:

RSS:

Answers

Answers + Comments

Markdown Basics

*italic* or _italic_
**bold** or __bold__
link:[text](http://url.com/ "Title")
image?![alt text](/path/img.jpg "Title")
numbered list: 1. Foo 2. Bar
to add a line break simply add two spaces to where you would like the new line to be.
basic HTML tags are also supported

learn more about Markdown

Tags:

field-extraction ×351
inputs ×186
csv ×95

Asked: 05 Apr '10, 07:42

Seen: 1,440 times

Last updated: 02 Aug '11, 10:43

how to ignore the titile line of the csv file in the result? and display in a KV format?

Follow this question

Splunk Resources

Related questions