Replace before importing the data in splunk

[abhayneilam]

Hi,
I have a file which contains the below content:

abhay|vikram|singh|26|kolkata
murari|kumar|singh|28|mumbai

I want to replace "|" to "\ |" before importing to the splunk, I have heard that it is possible if I write it in props.conf but it is not working, Kindly suggest me how to solve this problem as this is needed in urgent basis

Thanks in advance

[lrhazi]

Maybe this is what you need: http://docs.splunk.com/Documentation/Splunk/5.0/Data/Anonymizedatausingconfigurationfiles

[Ayn]

You're trying to solve the wrong problem. The real problem is why your delimiters aren't working as they should.

[smolcj]

i have the same problem, how to replace \ with \\ while searching?
thankyou for ur time

[gkanapathy]

Unclear to me why you want to do this, or why this would be helpful to you after the data has been imported.

[lrhazi]

What is "haha" ?
also, try and add a back slash "\" before the first pipe character in the sed command. this forum seems to remove my backslashes:

SEDCMD-dekh=s/|/ |/g

[abhayneilam]

[haha]
SHOULD_LINEMERGE = False
SEDCMD-dekh=s/|/ |/g
REPORT-dekh=dekhbhai

this is my props.conf but it is not working properly

[lrhazi]

That should be:

[source::.../abc.log]
SEDCMD-abc = s/|/ |/g

s for substitute, and g for global, replace all occurrences, not just the first.

[lrhazi]

The page linked before shows really examples. No?

You should show the relevant part of your props.conf so people can help you.

I have not used this before, but I would try something like:

[source::.../abc.log]
SEDCMD-abc = y/|/ |/

That's trying to say: replace any "|" with " |"

[abhayneilam]

I am trying to use in props.conf but it is not working kindly help me out with some real example

Thanks for your help