<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: multiple delimeter in transforms.conf is not working in Getting Data In</title>
    <link>https://community.splunk.com/t5/Getting-Data-In/multiple-delimeter-in-transforms-conf-is-not-working/m-p/22588#M3500</link>
    <description>&lt;P&gt;I think you should just be defining your delim ONCE not sure why you have it defined twice.&lt;BR /&gt;
I believe you only specify it in that format when you want to key:pair value your data (which it doesn't appear you want to do).&lt;/P&gt;

&lt;P&gt;So try something like the following in your transforms.conf&lt;BR /&gt;
[my-extractions]&lt;BR /&gt;
DELIMS="|"&lt;BR /&gt;
FIELDS="first_name","middle_name","surname","age","location"&lt;/P&gt;

&lt;P&gt;This should split out all of your fields.&lt;/P&gt;</description>
    <pubDate>Mon, 28 Sep 2020 12:44:32 GMT</pubDate>
    <dc:creator>Lucas_K</dc:creator>
    <dc:date>2020-09-28T12:44:32Z</dc:date>
    <item>
      <title>multiple delimeter in transforms.conf is not working</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/multiple-delimeter-in-transforms-conf-is-not-working/m-p/22587#M3499</link>
      <description>&lt;P&gt;Hi,&lt;/P&gt;

&lt;P&gt;I have a data as : &lt;/P&gt;

&lt;P&gt;abhay|vikram|singh|26|kolkata&lt;BR /&gt;
murari|kumar|singh|28|mumbai&lt;/P&gt;

&lt;P&gt;and in  my transfoms.conf I have written:&lt;BR /&gt;
DELIMS="|","|"&lt;BR /&gt;
but it is not working, it is only working for "|" delimeter but not for "|" delimeter,&lt;/P&gt;

&lt;P&gt;How to make it work please let me know because if I dont use "|" as a delimeter then&lt;/P&gt;

&lt;P&gt;singh|26  and&lt;BR /&gt;
singh|28  both will will be considered as a single field value but "singh" is a separate value and "26" is a separate value&lt;/P&gt;

&lt;P&gt;Please help &lt;/P&gt;

&lt;P&gt;Thanks in advance&lt;/P&gt;</description>
      <pubDate>Sun, 04 Nov 2012 17:45:27 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/multiple-delimeter-in-transforms-conf-is-not-working/m-p/22587#M3499</guid>
      <dc:creator>abhayneilam</dc:creator>
      <dc:date>2012-11-04T17:45:27Z</dc:date>
    </item>
    <item>
      <title>Re: multiple delimeter in transforms.conf is not working</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/multiple-delimeter-in-transforms-conf-is-not-working/m-p/22588#M3500</link>
      <description>&lt;P&gt;I think you should just be defining your delim ONCE not sure why you have it defined twice.&lt;BR /&gt;
I believe you only specify it in that format when you want to key:pair value your data (which it doesn't appear you want to do).&lt;/P&gt;

&lt;P&gt;So try something like the following in your transforms.conf&lt;BR /&gt;
[my-extractions]&lt;BR /&gt;
DELIMS="|"&lt;BR /&gt;
FIELDS="first_name","middle_name","surname","age","location"&lt;/P&gt;

&lt;P&gt;This should split out all of your fields.&lt;/P&gt;</description>
      <pubDate>Mon, 28 Sep 2020 12:44:32 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/multiple-delimeter-in-transforms-conf-is-not-working/m-p/22588#M3500</guid>
      <dc:creator>Lucas_K</dc:creator>
      <dc:date>2020-09-28T12:44:32Z</dc:date>
    </item>
  </channel>
</rss>

