I am using a search-time field extraction with transform being used.
the events only contain values -no field names- and they are all separated by commas which makes me able to use DELIMS and FIELDS in transform.conf.
My problem is though that for some special conditions I want splunk to skip the comma, like if there is a backslash after the comma, I want it to gather up all the previous and next characters as one field.
for example, if the event is:
AAA,BBB,CCC,/CCC,DDD
splunk will create:
field1 = AAA
field2 = BBB
field3 = CCC
field4 = /CCC
field5 = DDD
but I want the fields to be:
field1 = AAA
field2 = BBB
field3 = CCC,/CCC
field4 = DDD
how can I achieve that?
While I don't have a play system available to try this, wouldn't you be able to define field3 something like:
(?