Text Analytics

[kavyatim]

Hi ,
I have a sample data with ~ as a seperator. The format of data is as follows.

"Request_ID~Submitter~Create_Date~Assigned_To~Last_Modified_By~Modified_Date~Status~Short_Description~tmp_PopUp_GUID~Category~Type~Item~Summary~Pending~Escalated~Closure_Code~MSISDN~Address~First_Name~Priority~Region~Surname~tmp_RegionID~Postal_Code~Date_of_Birth~ID_Number~Password~tmp_GroupSet."

I am unable to load data to splunk and extract the fields.I tried changing config files props and transforms but no results,I tried with IFX also.

While loading data to splunk , the following error is generated:
"Your entry was not saved. The following error was reported: SyntaxError: JSON.parse: unexpected character"

Can some one help me in resolving this?

[Ayn]

So if I understand you correctly you have regular CSV-formatted data with "~" as a delimiter. You could simply use DELIMS in transforms.conf:

[getmyfields]
DELIMS = "~"
FIELDS = "field1", "field2", "field3", ...

(change FIELDS to the fields in your specific dataset - Request_ID, Submitter, Create_Date and so on)

Then in props.conf:

[yoursourcetype]
REPORT-myfields = getmyfields