topic Re: Splunk CSV comma handling != Excel comma handling in Getting Data In

Splunk CSV comma handling != Excel comma handling

virtualpony — Mon, 04 Jun 2012 21:46:29 GMT

I have a CSV file that lines up fields perfectly in Excel, but when Splunk parses that same CSV data, it gets tripped up when it gets an event with an extra comma in it, even if each field is encapsulated with "quotes" like this:

"5/1/2012 12:15:43 AM","GeneralHostWarningEvent","warning","","USLAB1","Compute HCS","Issue detected on uslab1esxi04, reboot host."

See in the last field, there is a comma before reboot host. This is where Splunk ends that field and then events after this get misaligned.

Is this a bug that should be fixed, or am I going to need to backfill all my data with a force dimlimiter of some other character other than a comma?

Thanks

Re: Splunk CSV comma handling != Excel comma handling

Stefan_van_de_R — Wed, 06 Jun 2012 15:28:53 GMT

Your CSV file should work if you put the next line in your stanza in transforms.conf

[Your_stanza]
FIELDS="Time","EventType","Priority","somthing","location","client","description"
DELIMS=","

[Edit]
I did some more research and found out that multiple characters to split the CSV fields is not possible. You can use an regular expression instead to split your fields.
[/Edit]

Re: Splunk CSV comma handling != Excel comma handling

virtualpony — Wed, 06 Jun 2012 15:54:14 GMT

Thats what my stanza currently looks like.