set delimiter

[newbiesplunk]

Hi,
The key-pair values delimiter is ":" instead of "=", how to configure such that the colon ":" is also a delimiter? thks
I configured below:

props.conf
[test]
TRANSFORMS-delim=AddDelimiter

transforms.conf
[AddDelimiter]
DELIMS=":"

But it does not works.

[lguinn2]

I think this will work

props.conf

[yoursourcetypehere]
KV_MODE = none
REPORT-extract1 = special-field-extraction

transforms.conf

[special-field-extraction]
DELIMS = " ", ":"
MV_ADD = true

I believe that you need two values for the DELIMS attribute - the first is the list of characters that can separate fields, so I set it to a space. The second value identifies the separator between the field name and its value, so I set it to ":".
Setting KV_MODE to none in props.conf disables the default field extraction, which is based on "=". MV_ADD allows multi-value fields, but you can remove this line if it doesn't apply.

[somesoni2]

Try adding this to props.conf

[test]
SEDCMD-replacecolon = s/:/=/g

[kristian_kolb]

Hmm, since that would mean that _raw is rewritten, it could mess up timestamps, which regularly use colons.
/k