Getting Data In

Hunk - specify delimiter when using SplunkLineRecordReader

conwaygene
Engager

How does one specify the delimiter when using SplunkLineRecordReader? Trying to read in a csv file with a header and delimited by '|'. Currently, Splunk is reading in the line as one field.

Thanks.

Tags (3)
0 Karma

Ledion_Bitincka
Splunk Employee
Splunk Employee

Given that | is not part of commonly used CSV formats out there you'd have to use Hunk's delimiter based KV extraction by using props/transforms.conf

$SPLUNK_HOME/etc/apps/search/local/props.conf
[my-sourcetype]
REPORT-delim = pipe-extractor

$SPLUNK_HOME/etc/apps/search/local/transforms.conf
[pipe-extractor]
FIELDS = field1,field2, ....
DELIMS = | 

You can read a blog post about the technique here

conwaygene
Engager

Now working. You rock!

0 Karma
Get Updates on the Splunk Community!

Splunk App for Anomaly Detection End of Life Announcement

Q: What is happening to the Splunk App for Anomaly Detection?A: Splunk is officially announcing the ...

Aligning Observability Costs with Business Value: Practical Strategies

 Join us for an engaging Tech Talk on Aligning Observability Costs with Business Value: Practical ...

Mastering Data Pipelines: Unlocking Value with Splunk

 In today's AI-driven world, organizations must balance the challenges of managing the explosion of data with ...