How to set line breaker after a certain number of fields has been read?

[tamduong16]

I have a csv file which has 13 columns. For some reason Splunk sometime append the next line of the csv into the same event. How could I tell splunk to start a new event after the 13 field has been read?

[DalJeanis]

@tamduong - that is unlikely to be the correct question, based on your earlier problems with trying to remove quotes. Please post your current extract and transform settings, along with a few realistic samples of the data, with sensitive or confidential data masked, and we can help you get this all straightened out.

The accurate answer to THIS question might be to hard code an extraction with a certain number of commas, for example, discarding everything after the thirteenth comma. However, I suspect that we just need to correctly inform the system about how to handle quotes in your csv file.

[cpetterborg]

Can you provide some examples?

[somesoni2]

What sourcetype have you selected? If you're using a custom sourcetype, what event parsing configuration (props.conf/transforms.conf) you've setup?

[tamduong16]

i select csv as my sourcetype