How to configure props.conf to parse CSV-like data with delimiters that contain multiple characters?

[vantasy1208]

Hi Guys,

I have a problem when I want to parse CSV-like data as the following,

field1_name#XDSP#C#S#field2_name#XDSP#C#S#field3_name#XDSP#C#S#field4_name
1#XDSP#C#S#2#XDSP#C#S#3#XDSP#C#S#4
10#XDSP#C#S#20#XDSP#C#S#30#XDSP#C#S#40
100#XDSP#C#S#200#XDSP#C#S#300#XDSP#C#S#400

The first line has field names and the rest are values.
Essentially the data is structured like CSV. I want Splunk to parse them as a CSV file, so I used FIELD_DELIMITER and HEADER_FIELD_DELIMITER attributes in props.conf, and configured Splunk the delimiter as #XDSP#C#S#. However, it is seems that the FIELD_DELIMITER can only be a single character.

Anyone have good idea to deal with that?
Any suggestions will be appreciated, thank u very much.

[richgalloway]

The way I read the Admin manual, FIELD_DELIMITER must be a single character.

I suggest writing a scripted input to parse the file and convert it into a form Splunk can ingest easier.