Getting Data In

parse fields with multiple delimiters

utsavkb
New Member

I am using HUNK 6.1.1. I have the data in the below format in a csv file,

Description= Small Focus

EventID= 023

Index: 95

TimeStamp: 2013-07-03T04:14:38

AdditionalInfo= [FREE_TEXT] Last update : 11-07-13 00:02:49 Reset date : 10-05-09 00:31:26 exposure time : 30.316 s exposure counter : 1181.0

I have loaded the data from my HDFS location by creating a simple provider and index using csv loader, but i want to further parse the "AdditionInfo" field to extract the field-values (Last update,Reset date,exposure time & exposure counter) from it. The "AdditionalInfo" Column doesnt have a spefic delimiter.

How can I further parse the "AdditionalInfo" field so that I can use the field-values in it to generate some aggregates on these?

Tags (3)
0 Karma

Ledion_Bitincka
Splunk Employee
Splunk Employee

You should be able to use a few of the methods for extract fields at search time:

  1. Interactive field extractor
  2. Config files (props/transforms.conf)
0 Karma
Get Updates on the Splunk Community!

Platform Highlights | November 2022 Newsletter

 November 2022 Skill Up on Splunk with our New Builder Tech Talk SeriesCan you build it? Yes you can! *play ...

Splunk Education - Fast Start Program!

Welcome to Splunk Education! Splunk training programs are designed to enable you to get started quickly and ...

Five Subtly Different Ways of Adding Manual Instrumentation in Java

You can find the code of this example on GitHub here. Please feel free to star the repository to keep in ...