Getting Data In

What is the syntax to configure DELIMS= in transforms.conf for line breaking?

hagjos43
Contributor

I'm ingesting a custom sourcetype (output from a powershell script). Within the transforms.conf, how do I set the DELIMS=linebreak? I see that it can be done, but I cannot find the syntax to do so. Essentially I'm asking what is the value I need to place after the DELIMS= to accomplish this?

Many thanks!

0 Karma

alanden_splunk
Splunk Employee
Splunk Employee

I know this is an old question, but the audience should be asking whether the purpose is to extract fields with a transforms DELIMS configuration, or to separate each line to a separate event as the LINE_BREAKER =([ \r\n ]+) setting in the answer below suggests.

0 Karma

stephane_cyrill
Builder

Hi here is an example of usage:

props.conf:

[your_data_sourcetype ]
SHOULD_LINEMERGE = false
LINE_BREAKER =([ \r\n ]+)
REPORT - delims= commalist

transforms.conf:

[commalist ]
DELIMS = ","
FIELDS = field1 , field2 , field3 ,
...

you can also use in your props.conf options like:

LINE_BREAKER =..... 
SHOULD_LINEMERGE = false 
BREAK_ONLY_BEFORE = .....
MUST_BREAK_AFTER = .....
FIELD_DELIMITER =...

alanden_splunk
Splunk Employee
Splunk Employee

this separates lines into events, which may not be what is being asked, since DELIMS is used to do field extractions in transforms.conf.

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Community Content Calendar, September edition

Welcome to another insightful post from our Community Content Calendar! We're thrilled to continue bringing ...

Splunkbase Unveils New App Listing Management Public Preview

Splunkbase Unveils New App Listing Management Public PreviewWe're thrilled to announce the public preview of ...

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Are you leveraging automation to its fullest potential in your threat detection strategy?Our upcoming Security ...