https://community.splunk.com/t5/Getting-Data-In/Hunk-specify-delimiter-when-using-SplunkLineRecordReader/m-p/182941#M36660 <P>Now working. You rock!</P> Thu, 07 May 2015 18:17:13 GMT conwaygene 2015-05-07T18:17:13Z https://community.splunk.com/t5/Getting-Data-In/Hunk-specify-delimiter-when-using-SplunkLineRecordReader/m-p/182939#M36658 <P>How does one specify the delimiter when using SplunkLineRecordReader? Trying to read in a csv file with a header and delimited by '|'. Currently, Splunk is reading in the line as one field.</P> <P>Thanks.</P> Thu, 07 May 2015 15:34:40 GMT https://community.splunk.com/t5/Getting-Data-In/Hunk-specify-delimiter-when-using-SplunkLineRecordReader/m-p/182939#M36658 conwaygene 2015-05-07T15:34:40Z https://community.splunk.com/t5/Getting-Data-In/Hunk-specify-delimiter-when-using-SplunkLineRecordReader/m-p/182940#M36659 <P>Given that | is not part of commonly used CSV formats out there you'd have to use Hunk's delimiter based KV extraction by using props/transforms.conf</P> <PRE><CODE>$SPLUNK_HOME/etc/apps/search/local/props.conf [my-sourcetype] REPORT-delim = pipe-extractor $SPLUNK_HOME/etc/apps/search/local/transforms.conf [pipe-extractor] FIELDS = field1,field2, .... DELIMS = | </CODE></PRE> <P>You can read a blog post about the technique <A href="http://blogs.splunk.com/2013/03/11/quick-n-dirty-delimited-data-sourcetypes-and-you/">here</A> </P> Thu, 07 May 2015 18:03:33 GMT https://community.splunk.com/t5/Getting-Data-In/Hunk-specify-delimiter-when-using-SplunkLineRecordReader/m-p/182940#M36659 Ledion_Bitincka 2015-05-07T18:03:33Z https://community.splunk.com/t5/Getting-Data-In/Hunk-specify-delimiter-when-using-SplunkLineRecordReader/m-p/182941#M36660 <P>Now working. You rock!</P> Thu, 07 May 2015 18:17:13 GMT https://community.splunk.com/t5/Getting-Data-In/Hunk-specify-delimiter-when-using-SplunkLineRecordReader/m-p/182941#M36660 conwaygene 2015-05-07T18:17:13Z