Getting Data In

Hunk - specify delimiter when using SplunkLineRecordReader


How does one specify the delimiter when using SplunkLineRecordReader? Trying to read in a csv file with a header and delimited by '|'. Currently, Splunk is reading in the line as one field.


Tags (3)
0 Karma

Splunk Employee
Splunk Employee

Given that | is not part of commonly used CSV formats out there you'd have to use Hunk's delimiter based KV extraction by using props/transforms.conf

REPORT-delim = pipe-extractor

FIELDS = field1,field2, ....

You can read a blog post about the technique here


Now working. You rock!

0 Karma
Get Updates on the Splunk Community!

The Great Resilience Quest: 10th Leaderboard Update

The tenth leaderboard update (11.23-12.05) for The Great Resilience Quest is out >> As our brave ...

Customer Experience | Call for Stories: Your 2023 Journey with Splunk!

Share your Splunk journey: Splunk is committed to supporting our customers toward success. As the year draws ...

Infographic provides the TL;DR for the 2023 Splunk Career Impact Report

We’ve been shouting it from the rooftops! The findings from the 2023 Splunk Career Impact Report showing that ...