Getting Data In

Hunk - specify delimiter when using SplunkLineRecordReader


How does one specify the delimiter when using SplunkLineRecordReader? Trying to read in a csv file with a header and delimited by '|'. Currently, Splunk is reading in the line as one field.


Tags (3)
0 Karma

Splunk Employee
Splunk Employee

Given that | is not part of commonly used CSV formats out there you'd have to use Hunk's delimiter based KV extraction by using props/transforms.conf

REPORT-delim = pipe-extractor

FIELDS = field1,field2, ....

You can read a blog post about the technique here


Now working. You rock!

0 Karma