In this blog we are going to see different ways to remove header (unwanted headers) that we get when we ingest our data. To achieve this we are going to edit our props.conf and transforms.conf, let’s get started.

Method 1:
First, we are going to see the setting FIELD_HEADER_REGEX, in this we specify a regular expression that matches our header we want to exclude. Let’s use our demo data here, go to “Settings > Add Data” select your file click on Next.

After applying FIELD_HEADER_REGEX setting, you will notice that Header has been removed:

Method 2:
Next setting we are going to see HEADER_FIELD_LINE_NUMBER, in this we specify the number of line that contains the header, as shown below:

Method 3:
Now, the method we are going to see is very important. When we want to remove Header text from modular inputs the above methods might not work, in that case we have to use this method. Let me give you an overview of what we are going to do, we will send our header to null queue by editing our props.conf and transforms.conf and the indexing license is not affected by sending the events which we don’t want to null queue.
To achieve this, we need to edit our props.conf and transforms.conf as shown below:

props.conf

[demo]
TRANSFORMS-null= setnull

transforms.conf

[setnull]
REGEX = ^####HEADER
DEST_KEY = queue
FORMAT = nullQueue

As you will notice in transforms.conf, we are writing a regex that will match our header which we want to remove and then we are sending it to null queue using DEST_KEY and FORMAT setting. The result is as follows, notice the sourcetype name is the one which we defined in props.conf and also the setting defined in it:

If you are still facing an issue regarding different ways to remove header (unwanted headers) . Feel free to Ask Doubts in the Comment Section Below and Don’t Forget to Follow us on 👍 Social Networks. Happy Splunking 😉