Dashboards & Visualizations

Text Analytics

kavyatim
Path Finder

Hi ,
I have a sample data with ~ as a seperator. The format of data is as follows.

"Request_ID~Submitter~Create_Date~Assigned_To~Last_Modified_By~Modified_Date~Status~Short_Description~tmp_PopUp_GUID~Category~Type~Item~Summary~Pending~Escalated~Closure_Code~MSISDN~Address~First_Name~Priority~Region~Surname~tmp_RegionID~Postal_Code~Date_of_Birth~ID_Number~Password~tmp_GroupSet."

I am unable to load data to splunk and extract the fields.I tried changing config files props and transforms but no results,I tried with IFX also.

While loading data to splunk , the following error is generated:
"Your entry was not saved. The following error was reported: SyntaxError: JSON.parse: unexpected character"

Can some one help me in resolving this?

Tags (1)
0 Karma

Ayn
Legend

So if I understand you correctly you have regular CSV-formatted data with "~" as a delimiter. You could simply use DELIMS in transforms.conf:

[getmyfields]
DELIMS = "~"
FIELDS = "field1", "field2", "field3", ...

(change FIELDS to the fields in your specific dataset - Request_ID, Submitter, Create_Date and so on)

Then in props.conf:

[yoursourcetype]
REPORT-myfields = getmyfields
Get Updates on the Splunk Community!

Developer Spotlight with Brett Adams

In our third Spotlight feature, we're excited to shine a light on Brett—a Splunk consultant, innovative ...

Index This | What can you do to make 55,555 equal 500?

April 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Say goodbye to manually analyzing phishing and malware threats with Splunk Attack ...

In today’s evolving threat landscape, we understand you’re constantly bombarded with phishing and malware ...