https://community.splunk.com/t5/Getting-Data-In/parse-fields-with-multiple-delimiters/m-p/131045#M26945 <P>I am using HUNK 6.1.1. I have the data in the below format in a csv file,</P> <P>Description= Small Focus </P> <P>EventID= 023 </P> <P>Index: 95 </P> <P>TimeStamp: 2013-07-03T04:14:38</P> <P>AdditionalInfo= [FREE_TEXT] Last update : 11-07-13 00:02:49 Reset date : 10-05-09 00:31:26 exposure time : 30.316 s exposure counter : 1181.0</P> <P>I have loaded the data from my HDFS location by creating a simple provider and index using csv loader, but i want to further parse the "AdditionInfo" field to extract the field-values (Last update,Reset date,exposure time &amp; exposure counter) from it. The "AdditionalInfo" Column doesnt have a spefic delimiter.</P> <P>How can I further parse the "AdditionalInfo" field so that I can use the field-values in it to generate some aggregates on these?</P> Fri, 04 Jul 2014 06:12:04 GMT utsavkb 2014-07-04T06:12:04Z https://community.splunk.com/t5/Getting-Data-In/parse-fields-with-multiple-delimiters/m-p/131045#M26945 <P>I am using HUNK 6.1.1. I have the data in the below format in a csv file,</P> <P>Description= Small Focus </P> <P>EventID= 023 </P> <P>Index: 95 </P> <P>TimeStamp: 2013-07-03T04:14:38</P> <P>AdditionalInfo= [FREE_TEXT] Last update : 11-07-13 00:02:49 Reset date : 10-05-09 00:31:26 exposure time : 30.316 s exposure counter : 1181.0</P> <P>I have loaded the data from my HDFS location by creating a simple provider and index using csv loader, but i want to further parse the "AdditionInfo" field to extract the field-values (Last update,Reset date,exposure time &amp; exposure counter) from it. The "AdditionalInfo" Column doesnt have a spefic delimiter.</P> <P>How can I further parse the "AdditionalInfo" field so that I can use the field-values in it to generate some aggregates on these?</P> Fri, 04 Jul 2014 06:12:04 GMT https://community.splunk.com/t5/Getting-Data-In/parse-fields-with-multiple-delimiters/m-p/131045#M26945 utsavkb 2014-07-04T06:12:04Z https://community.splunk.com/t5/Getting-Data-In/parse-fields-with-multiple-delimiters/m-p/131046#M26946 <P>You should be able to use a few of the methods for extract fields at search time:</P> <OL> <LI><A href="http://docs.splunk.com/Documentation/Splunk/6.1.1/Knowledge/ExtractfieldsinteractivelywithIFX">Interactive field extractor</A> </LI> <LI><A href="http://docs.splunk.com/Documentation/Splunk/6.1.1/Knowledge/Createandmaintainsearch-timefieldextractionsthroughconfigurationfiles">Config files</A> (props/transforms.conf)</LI> </OL> Mon, 07 Jul 2014 18:04:04 GMT https://community.splunk.com/t5/Getting-Data-In/parse-fields-with-multiple-delimiters/m-p/131046#M26946 Ledion_Bitincka 2014-07-07T18:04:04Z