Is the header row always the same? If so, then just create a regex that matches, and put that in the code I posted in the answer.
Ah - i see how Props.conf can be configured when but how to i update the associated Transforms.conf file?
thanks! John
You can use props.conf and transforms.conf to remove the header rows.
For example, if your header row starts with a # character, then the configuration would look like this:
Create these configs on the indexer.
Props.conf
[sourcetype]
TRANSFORMS-removeheader = removeheaderrow
Transforms.conf
[removeheaderrow]
REGEX = ^\#.*
DEST_KEY = queue
FORMAT = nullQueue
Can you post an example of the header row?