Getting Data In

multiple delimeter in transforms.conf is not working

abhayneilam
Contributor

Hi,

I have a data as :

abhay|vikram|singh|26|kolkata
murari|kumar|singh|28|mumbai

and in my transfoms.conf I have written:
DELIMS="|","|"
but it is not working, it is only working for "|" delimeter but not for "|" delimeter,

How to make it work please let me know because if I dont use "|" as a delimeter then

singh|26 and
singh|28 both will will be considered as a single field value but "singh" is a separate value and "26" is a separate value

Please help

Thanks in advance

0 Karma

Lucas_K
Motivator

I think you should just be defining your delim ONCE not sure why you have it defined twice.
I believe you only specify it in that format when you want to key:pair value your data (which it doesn't appear you want to do).

So try something like the following in your transforms.conf
[my-extractions]
DELIMS="|"
FIELDS="first_name","middle_name","surname","age","location"

This should split out all of your fields.

Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Self-Healing Pipeline Is Now Generally Available: AI-Powered CIM Compliance

Maintaining data integrity across security and analytics pipelines is an ongoing challenge. Data ...

[Puzzles] Solve, Learn, Repeat: Family Trees

This puzzle (first published here is based on finding grandparents and grandchildren (inspired by a question ...

Break the Build: Inside the KubeDoom Lounge at .conf26

    You step up to the machine. The pixelated corridors of a certain 1993 FPS load in front of you, EMP Pulse ...