Getting Data In

multiple delimeter in transforms.conf is not working

abhayneilam
Contributor

Hi,

I have a data as :

abhay|vikram|singh|26|kolkata
murari|kumar|singh|28|mumbai

and in my transfoms.conf I have written:
DELIMS="|","|"
but it is not working, it is only working for "|" delimeter but not for "|" delimeter,

How to make it work please let me know because if I dont use "|" as a delimeter then

singh|26 and
singh|28 both will will be considered as a single field value but "singh" is a separate value and "26" is a separate value

Please help

Thanks in advance

0 Karma

Lucas_K
Motivator

I think you should just be defining your delim ONCE not sure why you have it defined twice.
I believe you only specify it in that format when you want to key:pair value your data (which it doesn't appear you want to do).

So try something like the following in your transforms.conf
[my-extractions]
DELIMS="|"
FIELDS="first_name","middle_name","surname","age","location"

This should split out all of your fields.

Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...