topic Re: delimited by comma but not .csv file in Getting Data In

delimited by comma but not .csv file

kavana — Wed, 15 Feb 2017 02:26:11 GMT

I have a jobinfo.log file in my server, it was delimited by comma but not [xxxx.csv] file.
So it can not be added into index just like [.csv].

I don't want to change the extension from [.log] to [.csv],but the extension has to be changed ?

Below is the jobinfo.log file

80925610,00004105,00000000,10660,"20170213140245","20170213140245",1,0,0,"ro,o,t","root"
80925612,00004106,00000000,10660,"20170213140250","20170213140250",1,0,0,"ro,o,t","root"
80925626,00004125,00000000,10660,"20170213140411","20170213140411",1,0,0,"ro,o,t","root"

You can see that the comma also in double quotation, so if the extension is not [.csv] then the result will be below

1,0,0,"ro,o,t","root" -> 1,0,0,ro,o,t,root #the string "ro,o,t" also be delimited by comma

Re: delimited by comma but not .csv file

JDukeSplunk — Thu, 16 Feb 2017 18:07:53 GMT

So are you just trying to bring this data in so that it will be separated into fields like a csv would be?

In that case bring the data in as a sourcetype (preferably unique sourcetype name), open it in search, expand one line, click "Event Actions" and use the field extractor. Choose "delimiters" , choose comma, and name the fields. This will create a transforms and props.conf for this sourcetype.

Or edit the transforms & props.conf files
https://answers.splunk.com/answers/170251/how-to-extract-two-fields-separated-by-delimiter-c.html

Re: delimited by comma but not .csv file

DalJeanis — Thu, 16 Feb 2017 19:24:06 GMT

For this source, set up your props.conf with these and it should extract correctly.

FIELD_DELIMITER = ,
FIELD_QUOTE = "

Re: delimited by comma but not .csv file

somesoni2 — Thu, 16 Feb 2017 20:07:50 GMT

It doesn't have to be a *.csv file to be able to use the sourcetype definition (event breaking, timestamp recognition etc) of built-in sourcetype csv. When you setup the data monitoring (input.conf), just explicitly assign the sourcetype as "csv".

Re: delimited by comma but not .csv file

kavana — Fri, 17 Feb 2017 00:16:21 GMT

thank you so much!

it's worked !