Getting Data In

Removing Header row after outputcsv command

efelder0
Communicator

What are some of the methods that I can remove the header row after running the 'outputcsv' command in my search?

Here are some of the fields in that header row:

CreateTimeStamp_GMT Data_Source Reference_Number SourceIP_Address Incident_Category

Tags (1)
1 Solution

itinney
Path Finder
  1. If the header row is in an event of its own, then use a Transform to send it to the Null Queue.
  2. Else If the header row is in a multi-line event, use SEDCMD to strip it out.

Option 1 is documented here: http://docs.splunk.com/Documentation/Splunk/4.3/Deploy/Routeandfilterdatad#Filter_event_data_and_sen...

Option 2 is documented here:http://docs.splunk.com/Documentation/Splunk/4.3/Data/Anonymizedatausingconfigurationfiles#Through_a_...


Oh sorry I notice that this is after using outputcsv! No you cannot do it.

View solution in original post

Rob
Splunk Employee
Splunk Employee

Pretty sure that there is no way to do this when the outputcsv command is called to generate the csv file with events from your search results. I would recommend using a script to clean up the CSV file after its been generated for which SED would be useful or using batch/cmd/powershell on Win systems.

itinney
Path Finder
  1. If the header row is in an event of its own, then use a Transform to send it to the Null Queue.
  2. Else If the header row is in a multi-line event, use SEDCMD to strip it out.

Option 1 is documented here: http://docs.splunk.com/Documentation/Splunk/4.3/Deploy/Routeandfilterdatad#Filter_event_data_and_sen...

Option 2 is documented here:http://docs.splunk.com/Documentation/Splunk/4.3/Data/Anonymizedatausingconfigurationfiles#Through_a_...


Oh sorry I notice that this is after using outputcsv! No you cannot do it.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...