Getting Data In

What is the syntax to configure DELIMS= in transforms.conf for line breaking?

hagjos43
Contributor

I'm ingesting a custom sourcetype (output from a powershell script). Within the transforms.conf, how do I set the DELIMS=linebreak? I see that it can be done, but I cannot find the syntax to do so. Essentially I'm asking what is the value I need to place after the DELIMS= to accomplish this?

Many thanks!

0 Karma

alanden_splunk
Splunk Employee
Splunk Employee

I know this is an old question, but the audience should be asking whether the purpose is to extract fields with a transforms DELIMS configuration, or to separate each line to a separate event as the LINE_BREAKER =([ \r\n ]+) setting in the answer below suggests.

0 Karma

stephane_cyrill
Builder

Hi here is an example of usage:

props.conf:

[your_data_sourcetype ]
SHOULD_LINEMERGE = false
LINE_BREAKER =([ \r\n ]+)
REPORT - delims= commalist

transforms.conf:

[commalist ]
DELIMS = ","
FIELDS = field1 , field2 , field3 ,
...

you can also use in your props.conf options like:

LINE_BREAKER =..... 
SHOULD_LINEMERGE = false 
BREAK_ONLY_BEFORE = .....
MUST_BREAK_AFTER = .....
FIELD_DELIMITER =...

alanden_splunk
Splunk Employee
Splunk Employee

this separates lines into events, which may not be what is being asked, since DELIMS is used to do field extractions in transforms.conf.

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...