How do I edit my configuration to ignore indexing the first line of my CSV file?

[jaxjohnny]

I have a CSV file with about 200 fields in it. The first line is useless, and the second line contains the field names. However, the field names are not delimited with a quote and a comma, but only a comma. The fields are delimited with both quotes and commas.

I've tried the inputs, props, and transforms.conf as below. I also have some sample data below
inputs.conf

[monitor:///$SPLUNK_HOME/etc/apps/search/lookups/ControlUp_Computers_05_14_2016_15_00_20.csv]
sourcetype=ControlUPComputer
index = main
disabled = false
interval = 60

Props.conf

[ControlupComputer]
DATETIME_CONFIG = CURRENT
INDEXED_EXTRACTIONS = csv
KV_MODE = none
NO_BINARY_CHECK = 1
SHOULD_LINEMERGE = false
pulldown_type = 1
HEADER_FIELD_DELIMITER = ,
HEADER_FIELD_LINE_NUMBER = 2
FIELD_QUOTE = "
FIELD_DELIMITER = ","
TRANSFORMS-ControlupComputer = ControlupComputerTransform

transforms.conf

[ControlupComputerTransform]
DELIMS = ,
FIELDS = Stress Level,Name,Status,Operating System,System Type,CPU Count,Memory,Uptime,User 

Sample data from CSV file - Notice the text "Table:Computers"? That is what I need to ignore

Table: Computers
Stress Level,Name,Status,Operating System,System Type,CPU Count,Memory,Uptime,User Sessions,CPU,Memory Utilization,Disk Queue,Free Space on System Drive,XenApp Server Load,Avg. Disk Read Time,Avg. Disk Write Time,Net Total,Sessions,XenApp Server Logon Mode,Net Sent,Net Received,Domain DNS,Domain Role,OS Service Pack,Organization,Processes,Install Date,Last Boot,Manufacturer,Model,View Agent Version,Windows Directory,Pages / sec,Disk Reads / sec,Non-paged Pool Memory,Disk Writes / sec,Disk Transfers / sec,Error Rate,Warning Rate,IP Addresses,DNS A Records,Physical Addresses,Registered IP Addresses,Active Sessions,Idle Sessions,Disconnected Sessions,Other Sessions,Max Free Space Drive,Min Free Space Drive,Top Citrix License Utilization,Folder,Description,Processor Queue Length,Paging File,Physical Disk Time,XenApp Resolution Time (ms),XenApp DataStore Connection Failure,XenApp Number of busy XML threads,XenApp Resolution WorkItem Queue Ready Count,WorkItem Queue Ready count,XenApp License Server Connection Failure,XenApp License Check-Out Time (ms),XenDesktop Database Avg. Trasaction Time,XenDesktop Database Connected,XenDesktop Database Transaction Errors / sec,ASP Request Queued,ASP Request Rejected,CSG Connections,XenApp Load Evaluator,XenApp Worker Group,XenApp Farm,XenApp Zone,XenApp Zone Data Collector,XenApp #Published Applications,XenApp Version,XenApp Edition,XenDesktop Desktop Group,XenDesktop Farm Name,XenDesktop Desktop Kind,XenDesktop Desktop State,VDA Version,XenDesktop Catalog Name,XenDesktop MCS Image Out of Date,PVS vDisk File Name,Computer Local Time,Logon Server,Avg. Logon Duration,Guest Name,Host Name,VM Name,VM Power State,VM Tools State,VM Tools Version,VM Tools Version State,Active memory,Host CPU Usage,Physical memory used,Dropped Received Packets,Dropped Transmitted Packets,CPU Ready,CPU Excessive SMP use,CPU System time,CPU Swap Wait,Memory SwapIn Rate,Memory SwapOut Rate,Virtual Disk Read IOPS,Virtual Disk Write IOPS,Virtual Disk Reads KBps,Virtual Disk Writes KBps,Virtual Disk Read Latency,Virtual Disk Write Latency,Hypervisor Platform
"2.00","","Ready","Windows Server 2008 R2 Enterprise ","x64","4","20 (GB)","10:15 hours","0","0.4025722","22","0.001513883","28,918,460,000.00 (C:)","1206","0.00","0.01","0.1881534","2","AllowLogons","0.1138949","0.07425845",".com","MemberServer","Service Pack 1","of FL","88","10/8/2012 9:14:34 PM","5/14/2016 4:45:03 AM","VMware, Inc.","VMware Virtual Platform","N/A","C:\Windows","0","0","2.301047E+09","0","0","0","0","10.8.202.98","10.8..98","00-50-56-8B-4E-F1","1","0","0","0","0","28,918,460,000.00 (C:)","20,163,130,000.00 (F:)","0.00","blue\servers\2008\terminal servers\vendor","","0","0","0.02158756","0","0","0","0","0","0","0","0","0.00","0","0","0","0","Standard Load Eval","All_Servers
Vendor

[woodcock]

PAY SPECIAL ATTENTION TO THE CASING (upper/lower/mixed) OF THE SOURCETYPE EVERYWHERE IT IS USED!

Try these:

inputs.conf:

[monitor:///$SPLUNK_HOME/etc/apps/search/lookups/ControlUp_Computers_05_14_2016_15_00_20.csv]
sourcetype=ControlUPComputer
index = main

props.conf

[ControlUPComputer]
DATETIME_CONFIG = CURRENT
INDEXED_EXTRACTIONS = CSV
HEADER_FIELD_LINE_NUMBER = 2
HEADER_FIELD_DELIMITER = ,
FIELD_QUOTE = "
FIELD_DELIMITER = ,

Put these both on your forwarder (YES, your forwarder) and restart the splunk instances there. Events indexed after the restart will be correct. Your big problem was the casing mismatch.

[muebel]

Hi jaxjohnny, I believe the PREAMBLE_REGEX props config is what you want here, i.e.

PREAMBLE_REGEX = Table: Computers

[jaxjohnny]

I added that to the props.conf. It didn't bring it in for some reason still

props.conf

[ControlupComputer]
DATETIME_CONFIG = CURRENT
PREAMBLE_REGEX = Table: Computers
INDEXED_EXTRACTIONS = csv
HEADER_FIELD_DELIMITER = ,
HEADER_FIELD_LINE_NUMBER = 2
FIELD_QUOTE = "
FIELD_DELIMITER = ","

inputs.conf

[monitor:///$SPLUNK_HOME/etc/apps/search/lookups/ControlUp_Computers_05_14_2016_15_00_20.csv]
sourcetype=ControlUPComputer
index = main
disabled = false
interval = 60