Getting Data In

Splunk CSV comma handling != Excel comma handling

Path Finder

I have a CSV file that lines up fields perfectly in Excel, but when Splunk parses that same CSV data, it gets tripped up when it gets an event with an extra comma in it, even if each field is encapsulated with "quotes" like this:

"5/1/2012 12:15:43 AM","GeneralHostWarningEvent","warning","","USLAB1","Compute HCS","Issue detected on uslab1esxi04, reboot host."

See in the last field, there is a comma before reboot host. This is where Splunk ends that field and then events after this get misaligned.

Is this a bug that should be fixed, or am I going to need to backfill all my data with a force dimlimiter of some other character other than a comma?


Tags (1)


Your CSV file should work if you put the next line in your stanza in transforms.conf


I did some more research and found out that multiple characters to split the CSV fields is not possible. You can use an regular expression instead to split your fields.

0 Karma

Path Finder

Thats what my stanza currently looks like.

0 Karma
Get Updates on the Splunk Community!

Devesh Logendran, Splunk, and the Singapore Cyber Conquest

At this year’s Splunk University, I had the privilege of chatting with Devesh Logendran, one of the winners in ...

There's No Place Like Chrome and the Splunk Platform

WATCH NOW!Malware. Risky Extensions. Data Exfiltration. End-users are increasingly reliant on browsers to ...

Customer Experience | Join the Customer Advisory Board!

Are you ready to take your Splunk journey to the next level? 🚀 We invite you to join our elite squad ...