Getting Data In

How to on-board comma separated csv data with pipes around each fields

mlevsh
Builder

Hi

Looking for the advice how to on-board the csv file with comma separated values but each field has pipes around it :   |field1|,|field2|,...,|fieldn|

Example:

Header:
ACTIVITY_LOG_Time,INGRESS_EGRESS_IND,DEST_FMLY_CD,DU_ID,CHANNEL,SBMTR_ID,PRPTY_VALUE_TX,BUSINESS_LINE,TECH_FNCTN_ID,ACTVY_STAT_ID,ACTVY_STAT_DS,ACTVY_SCSFL_IN,SMF_ID,DU_TRKNG_NB,PARTY_ACCT_ID,GROUP_USER,TOPIC_3_VALUE_TX,DU_MQMD_TX

Sample Event:
|2020-12-21-02.42.14.242001|,|Ingress|,|ABC|,|ZP00119842239341|,|MQ|,|G0000246|,NULL,|TRA|,|TRAM|,1,|MQ Message Queued|,|Y|,|001|,|ZP00119842239341|,||,|G0000246|,||,| (?åë&?áèä&è???<9d>³ú¬^]P?|


Thank you in advance

Labels (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Try these settings.

[mysourcetype]
INDEXED_EXTRACTIONS = CSV
FIELD_QUOTE = |
TIMESTAMP_FIELDS = ACTIVITY_LOG_Time
TIME_FORMAT = %Y-%m-%d %H:%M:%S.%6N
---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Dynamic formatting from XML events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  &#x1f680; Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Stronger Security with Federated Search for S3, GCP SQL & Australian Threat ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...