Getting Data In

Splunk CSV comma handling != Excel comma handling

virtualpony
Path Finder

I have a CSV file that lines up fields perfectly in Excel, but when Splunk parses that same CSV data, it gets tripped up when it gets an event with an extra comma in it, even if each field is encapsulated with "quotes" like this:

"5/1/2012 12:15:43 AM","GeneralHostWarningEvent","warning","","USLAB1","Compute HCS","Issue detected on uslab1esxi04, reboot host."

See in the last field, there is a comma before reboot host. This is where Splunk ends that field and then events after this get misaligned.

Is this a bug that should be fixed, or am I going to need to backfill all my data with a force dimlimiter of some other character other than a comma?

Thanks

Tags (1)

Stefan_van_de_R
Explorer

Your CSV file should work if you put the next line in your stanza in transforms.conf

[Your_stanza]
FIELDS="Time","EventType","Priority","somthing","location","client","description"
DELIMS=","

[Edit]
I did some more research and found out that multiple characters to split the CSV fields is not possible. You can use an regular expression instead to split your fields.
[/Edit]

0 Karma

virtualpony
Path Finder

Thats what my stanza currently looks like.

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...