topic Re: set delimiter in Getting Data In

set delimiter

newbiesplunk — Sat, 27 Sep 2014 05:24:44 GMT

Hi,
The key-pair values delimiter is ":" instead of "=", how to configure such that the colon ":" is also a delimiter? thks
I configured below:

props.conf
[test]
TRANSFORMS-delim=AddDelimiter

transforms.conf
[AddDelimiter]
DELIMS=":"

But it does not works.

Re: set delimiter

somesoni2 — Sat, 27 Sep 2014 07:32:08 GMT

Try adding this to props.conf

[test]
SEDCMD-replacecolon = s/:/=/g

Re: set delimiter

kristian_kolb — Sat, 27 Sep 2014 13:51:52 GMT

Hmm, since that would mean that _raw is rewritten, it could mess up timestamps, which regularly use colons.
/k

Re: set delimiter

lguinn2 — Sat, 27 Sep 2014 20:17:50 GMT

I think this will work

props.conf

[yoursourcetypehere]
KV_MODE = none
REPORT-extract1 = special-field-extraction

transforms.conf

[special-field-extraction]
DELIMS = " ", ":"
MV_ADD = true

I believe that you need two values for the DELIMS attribute - the first is the list of characters that can separate fields, so I set it to a space. The second value identifies the separator between the field name and its value, so I set it to ":".
Setting KV_MODE to none in props.conf disables the default field extraction, which is based on "=". MV_ADD allows multi-value fields, but you can remove this line if it doesn't apply.