Hunk - specify delimiter when using SplunkLineRecordReader

[conwaygene]

How does one specify the delimiter when using SplunkLineRecordReader? Trying to read in a csv file with a header and delimited by '|'. Currently, Splunk is reading in the line as one field.

Thanks.

[Ledion_Bitincka]

Given that | is not part of commonly used CSV formats out there you'd have to use Hunk's delimiter based KV extraction by using props/transforms.conf

$SPLUNK_HOME/etc/apps/search/local/props.conf
[my-sourcetype]
REPORT-delim = pipe-extractor

$SPLUNK_HOME/etc/apps/search/local/transforms.conf
[pipe-extractor]
FIELDS = field1,field2, ....
DELIMS = | 

You can read a blog post about the technique here

[conwaygene]

Now working. You rock!