https://community.splunk.com/t5/Splunk-Search/how-to-parse-a-semicolon-separated-file-for-a-lookup-file/m-p/332972#M159897 <P>@bheemireddi, converted your post to comment, since it is a follow up question, not the answer to the question being asked.</P> Wed, 26 Jul 2017 03:20:33 GMT niketn 2017-07-26T03:20:33Z https://community.splunk.com/t5/Splunk-Search/how-to-parse-a-semicolon-separated-file-for-a-lookup-file/m-p/332969#M159894 <P>I have a semicolon separated file that is to be used as a lookup file. How do you parse the file within the transforms.conf? I tried the DELIMS and FIELDS but no luck. I also tried to do the REGEX, and no luck. </P> Tue, 25 Jul 2017 16:10:47 GMT https://community.splunk.com/t5/Splunk-Search/how-to-parse-a-semicolon-separated-file-for-a-lookup-file/m-p/332969#M159894 SplunkDank 2017-07-25T16:10:47Z https://community.splunk.com/t5/Splunk-Search/how-to-parse-a-semicolon-separated-file-for-a-lookup-file/m-p/332970#M159895 <P>How does your props and transforms look?</P> Tue, 25 Jul 2017 16:51:20 GMT https://community.splunk.com/t5/Splunk-Search/how-to-parse-a-semicolon-separated-file-for-a-lookup-file/m-p/332970#M159895 bheemireddi 2017-07-25T16:51:20Z https://community.splunk.com/t5/Splunk-Search/how-to-parse-a-semicolon-separated-file-for-a-lookup-file/m-p/332971#M159896 <P>Can you add sample data, does it have header column? Are you planning to upload the file to index or lookup?</P> Wed, 26 Jul 2017 03:17:39 GMT https://community.splunk.com/t5/Splunk-Search/how-to-parse-a-semicolon-separated-file-for-a-lookup-file/m-p/332971#M159896 niketn 2017-07-26T03:17:39Z https://community.splunk.com/t5/Splunk-Search/how-to-parse-a-semicolon-separated-file-for-a-lookup-file/m-p/332972#M159897 <P>@bheemireddi, converted your post to comment, since it is a follow up question, not the answer to the question being asked.</P> Wed, 26 Jul 2017 03:20:33 GMT https://community.splunk.com/t5/Splunk-Search/how-to-parse-a-semicolon-separated-file-for-a-lookup-file/m-p/332972#M159897 niketn 2017-07-26T03:20:33Z https://community.splunk.com/t5/Splunk-Search/how-to-parse-a-semicolon-separated-file-for-a-lookup-file/m-p/332973#M159898 <P>Only CSV files can be used for lookups. You will need to write a script to convert the file from semi-colon separated to CSV. Or perhaps use a manual tool to convert the file to CSV (for example, Microsoft Excel can import data with arbitrary delimiters).</P> <P>Run the script and write the resulting CSV file to the lookups directory in the appropriate app. <BR /> Then put the settings in the transforms.conf in the local directory of the same app.<BR /> Only these settings apply to lookups tables:<A href="http://docs.splunk.com/Documentation/Splunk/latest/Admin/Transformsconf#Lookup_tables">http://docs.splunk.com/Documentation/Splunk/latest/Admin/Transformsconf#Lookup_tables</A></P> <P>DELIMS, FIELDS and REGEX are transformations that are applied to events as they are parsed and indexed. These settings do not apply to lookup tables.</P> Thu, 27 Jul 2017 05:31:47 GMT https://community.splunk.com/t5/Splunk-Search/how-to-parse-a-semicolon-separated-file-for-a-lookup-file/m-p/332973#M159898 lguinn2 2017-07-27T05:31:47Z https://community.splunk.com/t5/Splunk-Search/how-to-parse-a-semicolon-separated-file-for-a-lookup-file/m-p/332974#M159899 <P>If there is anybody still <STRONG>looking at finding an alternative for using commas in a csv lookup file</STRONG>, because they CAN'T use commas, because their fields contain commas, GOOD NEWS:<BR /> You can use <STRONG>quotes as text delimiters</STRONG> and commas as field delimiters in the following fashion:</P> <PRE><CODE>"field1","field2" "example1, that contains commas","something" "example2","" "","example3" </CODE></PRE> <P>Splunk correctly extracts field value pairs!</P> Mon, 13 May 2019 02:42:03 GMT https://community.splunk.com/t5/Splunk-Search/how-to-parse-a-semicolon-separated-file-for-a-lookup-file/m-p/332974#M159899 lydiapal_splunk 2019-05-13T02:42:03Z