Dashboards & Visualizations

Text Analytics

kavyatim
Path Finder

Hi ,
I have a sample data with ~ as a seperator. The format of data is as follows.

"Request_ID~Submitter~Create_Date~Assigned_To~Last_Modified_By~Modified_Date~Status~Short_Description~tmp_PopUp_GUID~Category~Type~Item~Summary~Pending~Escalated~Closure_Code~MSISDN~Address~First_Name~Priority~Region~Surname~tmp_RegionID~Postal_Code~Date_of_Birth~ID_Number~Password~tmp_GroupSet."

I am unable to load data to splunk and extract the fields.I tried changing config files props and transforms but no results,I tried with IFX also.

While loading data to splunk , the following error is generated:
"Your entry was not saved. The following error was reported: SyntaxError: JSON.parse: unexpected character"

Can some one help me in resolving this?

Tags (1)
0 Karma

Ayn
Legend

So if I understand you correctly you have regular CSV-formatted data with "~" as a delimiter. You could simply use DELIMS in transforms.conf:

[getmyfields]
DELIMS = "~"
FIELDS = "field1", "field2", "field3", ...

(change FIELDS to the fields in your specific dataset - Request_ID, Submitter, Create_Date and so on)

Then in props.conf:

[yoursourcetype]
REPORT-myfields = getmyfields
Get Updates on the Splunk Community!

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...