Getting Data In

multiple delimeter in transforms.conf is not working

abhayneilam
Contributor

Hi,

I have a data as :

abhay|vikram|singh|26|kolkata
murari|kumar|singh|28|mumbai

and in my transfoms.conf I have written:
DELIMS="|","|"
but it is not working, it is only working for "|" delimeter but not for "|" delimeter,

How to make it work please let me know because if I dont use "|" as a delimeter then

singh|26 and
singh|28 both will will be considered as a single field value but "singh" is a separate value and "26" is a separate value

Please help

Thanks in advance

0 Karma

Lucas_K
Motivator

I think you should just be defining your delim ONCE not sure why you have it defined twice.
I believe you only specify it in that format when you want to key:pair value your data (which it doesn't appear you want to do).

So try something like the following in your transforms.conf
[my-extractions]
DELIMS="|"
FIELDS="first_name","middle_name","surname","age","location"

This should split out all of your fields.

Get Updates on the Splunk Community!

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI! Discover how Splunk’s agentic AI ...

[Puzzles] Solve, Learn, Repeat: Dereferencing XML to Fixed-length events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Stay Connected: Your Guide to December Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...