I have a csv file that updates every now and then. I'm monitoring it via splunk. However the problem is that the firsl line of the file contains column names
for example: TIME;NAME;CAUSE;MONITOR;
and then comes the values 20190301;thename;problem; 1
I don't need column names to appear as event. however I was not able to find a solution that would work, I tried adding following lines in props.conf `HEADER_FIELD_LINE_NUMBER = 1
HEADER_FIELD_DELIMITER = ;
FIELD_DELIMITER = ;
`
but no success. suggestions?
↧