topic Re: Splunk does not detect pipe separated headers in Monitoring Splunk

Splunk does not detect pipe separated headers

awagner — Fri, 25 Oct 2013 15:04:41 GMT

Hi All,

I am trying to load files with headers. The files are simple pipe-separated files. I use the following in props.conf:

FIELD_DELIMITER="|"

In this case, the file is indexed, but the fields are not shown.

If I omit the ", like this:

FIELD_DELIMITER=|

the file is not indexed at all.

If I change all pipes to commas in the input file, and use

FIELD_DELIMITER=,

the file gets indexed, and the fields are all there.

Is there a way to get Splunk load pipe separated files? I don't want to define the fields in transform, because they keep changing from file to file.

Thanks,
Ambrus

yannK — Fri, 25 Oct 2013 15:27:55 GMT

Take a look at the new header field extraction since version 6.*.

try an escape character before
FIELD_DELIMITER = \|

awagner — Mon, 28 Sep 2020 15:05:23 GMT

Now I have this in props.conf:

FIELD_DELIMITER = "|"
HEADER_FIELD_DELIMITER = "|"
NO_BINARY_CHECK = 1
SHOULD_LINEMERGE = false
pulldown_type = 1

Still no luck. The file is indexed, but the fields are not there.

awagner — Fri, 25 Oct 2013 15:35:23 GMT

I also tried INDEXED_EXTRACTIONS = PSV, but no change.

awagner — Fri, 25 Oct 2013 15:42:57 GMT

I tried the backslash | version, still nothing.