Splunk Enterprise

What does this error mean? "Failed to properly initialize the key-value parser for transform_name 'REPORT-ua'. You must define least one delimiter."

bscavotto
New Member

What does this error mean?

Failed to properly initialize the key-value parser for transform_name 'REPORT-ua'. You must define least one delimiter.

Somebody on my team hosed our Splunk Light instance which is throwing this error. How do I remedy this?

0 Karma

fab73
Path Finder

Solution good for me : changed [REPORT-SYSTEM] DELIMS = "\"" instead of [REPORT-SYSTEM] DELIMS = """ IN

        /opt/splunk/etc/users/admin/search/local/transforms.conf

same result con be achieved typeing \" directly in console during field extraction insteaad of ".

0 Karma

fab73
Path Finder

I extracted a new valus using separated values extraction and I had the same problem :
Failed to properly initialize the key-value parser for transform_name 'REPORT-.....'. You must define least one delimiter.

Command $SPLUNK_HOME/bin/splunk cmd btool props list --debug | grep REPORT-....
doesn't return any result. Any idea?

0 Karma

jplumsdaine22
Influencer

The error means your props.conf or transforms.conf has an error in it. Can you post the offending stanzas here? If you're not sure where the config files are try

$SPLUNK_HOME/bin/splunk cmd btool props list --debug  | grep REPORT-ua

That should tell you which file contains the offending config item

0 Karma
Get Updates on the Splunk Community!

Splunk AI Assistant for SPL | Key Use Cases to Unlock the Power of SPL

Splunk AI Assistant for SPL | Key Use Cases to Unlock the Power of SPL  The Splunk AI Assistant for SPL ...

Buttercup Games: Further Dashboarding Techniques (Part 5)

This series of blogs assumes you have already completed the Splunk Enterprise Search Tutorial as it uses the ...

Customers Increasingly Choose Splunk for Observability

For the second year in a row, Splunk was recognized as a Leader in the 2024 Gartner® Magic Quadrant™ for ...