Getting Data In

How do I specify Ctrl-A (\x01) as a field delimiter in props.conf?

jimjh
Path Finder

How do I specify Ctrl-A (\u0001) as a field delimiter in props.conf?

I tried

[xxx]
FIELD_DELIMITER=\x01

[xxx]
FIELD_DELIMITER=^A

[xxx]
FIELD_DELIMITER=\u0001
Tags (2)
1 Solution

jimjh
Path Finder

Inside props.conf, use

REPORT-fields = kv_ctrl_sep

Inside transforms.conf, use

[kv_ctrl_sep]
FIELDS = x, y, z
CAN_OPTIMIZE = false
DELIMS = "

Then use python to print a \x01 character into transforms.conf

with open('transforms.conf', 'a') as f:
  f.write('\x01')

Finally, open up transforms.conf and add the closing quote.

View solution in original post

jimjh
Path Finder

Inside props.conf, use

REPORT-fields = kv_ctrl_sep

Inside transforms.conf, use

[kv_ctrl_sep]
FIELDS = x, y, z
CAN_OPTIMIZE = false
DELIMS = "

Then use python to print a \x01 character into transforms.conf

with open('transforms.conf', 'a') as f:
  f.write('\x01')

Finally, open up transforms.conf and add the closing quote.

Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Dynamic formatting from XML events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  🚀 Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Stronger Security with Federated Search for S3, GCP SQL & Australian Threat ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...