Getting Data In
Highlighted

How to set line breaker after a certain number of fields has been read?

Contributor

I have a csv file which has 13 columns. For some reason Splunk sometime append the next line of the csv into the same event. How could I tell splunk to start a new event after the 13 field has been read?

0 Karma
Highlighted

Re: How to set line breaker after a certain number of fields has been read?

SplunkTrust
SplunkTrust

What sourcetype have you selected? If you're using a custom sourcetype, what event parsing configuration (props.conf/transforms.conf) you've setup?

0 Karma
Highlighted

Re: How to set line breaker after a certain number of fields has been read?

Contributor

i select csv as my sourcetype

0 Karma
Highlighted

Re: How to set line breaker after a certain number of fields has been read?

SplunkTrust
SplunkTrust

Can you provide some examples?

0 Karma
Highlighted

Re: How to set line breaker after a certain number of fields has been read?

SplunkTrust
SplunkTrust

@tamduong - that is unlikely to be the correct question, based on your earlier problems with trying to remove quotes. Please post your current extract and transform settings, along with a few realistic samples of the data, with sensitive or confidential data masked, and we can help you get this all straightened out.

The accurate answer to THIS question might be to hard code an extraction with a certain number of commas, for example, discarding everything after the thirteenth comma. However, I suspect that we just need to correctly inform the system about how to handle quotes in your csv file.

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.