https://community.splunk.com/t5/Getting-Data-In/How-to-configure-props-conf-to-parse-CSV-like-data-with/m-p/256453#M49269 <P>The way I read the Admin manual, FIELD_DELIMITER must be a single character.</P> <P>I suggest writing a scripted input to parse the file and convert it into a form Splunk can ingest easier.</P> Tue, 06 Dec 2016 13:54:32 GMT richgalloway 2016-12-06T13:54:32Z https://community.splunk.com/t5/Getting-Data-In/How-to-configure-props-conf-to-parse-CSV-like-data-with/m-p/256452#M49268 <P>Hi Guys,</P> <P>I have a problem when I want to parse CSV-like data as the following,</P> <PRE><CODE>field1_name#XDSP#C#S#field2_name#XDSP#C#S#field3_name#XDSP#C#S#field4_name 1#XDSP#C#S#2#XDSP#C#S#3#XDSP#C#S#4 10#XDSP#C#S#20#XDSP#C#S#30#XDSP#C#S#40 100#XDSP#C#S#200#XDSP#C#S#300#XDSP#C#S#400 </CODE></PRE> <P>The first line has field names and the rest are values.<BR /> Essentially the data is structured like CSV. I want Splunk to parse them as a CSV file, so I used FIELD_DELIMITER and HEADER_FIELD_DELIMITER attributes in props.conf, and configured Splunk the delimiter as <CODE>#XDSP#C#S#</CODE>. However, it is seems that the FIELD_DELIMITER can only be a single character.</P> <P>Anyone have good idea to deal with that?<BR /> Any suggestions will be appreciated, thank u very much.</P> Tue, 29 Sep 2020 11:59:21 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-configure-props-conf-to-parse-CSV-like-data-with/m-p/256452#M49268 vantasy1208 2020-09-29T11:59:21Z https://community.splunk.com/t5/Getting-Data-In/How-to-configure-props-conf-to-parse-CSV-like-data-with/m-p/256453#M49269 <P>The way I read the Admin manual, FIELD_DELIMITER must be a single character.</P> <P>I suggest writing a scripted input to parse the file and convert it into a form Splunk can ingest easier.</P> Tue, 06 Dec 2016 13:54:32 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-configure-props-conf-to-parse-CSV-like-data-with/m-p/256453#M49269 richgalloway 2016-12-06T13:54:32Z