My data is parsed into CSV files with default comma delimiters.
Many fields contain one or more commas.
When I use this in props.conf:
[your_sourcetype]
EXTRACT-second_round = ^(?[^,]*),(?[^,]*),(?[^,]*),(?.*),(?[^,]*),(?[^,]*),(?[^,]*)
However, Commas could only be in field 4, it does not support multiple commas in fields.
Some may propose this approach:
props.conf
[your_sourcetype]
REPORT-blah = hash_delim
transforms.conf
[hash_delim]
DELIMS = "#"
FIELDS = field1, field2, field3 etc
However, I cannot find a delim which must not be in any fields.
Please help. Any suggestion?
Also, why would commas inside the double quotation marks will be considered as a delimiter in a csv?
try this :
[hash_delim]
DELIMS = ","
FIELDS = field1, field2, field3 etc
see this example below, Extract comma-delimited values into fields:
[extract_csv]
DELIMS = ","
FIELDS = "field1", "field2", "field3"
This example assigns the extracted values from _raw to field1, field2 and field3 (in order of extraction). If more than three values are extracted, the values without a matching field name are ignored.