Splunk Enterprise

What does this error mean? "Failed to properly initialize the key-value parser for transform_name 'REPORT-ua'. You must define least one delimiter."

bscavotto
New Member

What does this error mean?

Failed to properly initialize the key-value parser for transform_name 'REPORT-ua'. You must define least one delimiter.

Somebody on my team hosed our Splunk Light instance which is throwing this error. How do I remedy this?

0 Karma

fab73
Path Finder

Solution good for me : changed [REPORT-SYSTEM] DELIMS = "\"" instead of [REPORT-SYSTEM] DELIMS = """ IN

        /opt/splunk/etc/users/admin/search/local/transforms.conf

same result con be achieved typeing \" directly in console during field extraction insteaad of ".

0 Karma

fab73
Path Finder

I extracted a new valus using separated values extraction and I had the same problem :
Failed to properly initialize the key-value parser for transform_name 'REPORT-.....'. You must define least one delimiter.

Command $SPLUNK_HOME/bin/splunk cmd btool props list --debug | grep REPORT-....
doesn't return any result. Any idea?

0 Karma

jplumsdaine22
Influencer

The error means your props.conf or transforms.conf has an error in it. Can you post the offending stanzas here? If you're not sure where the config files are try

$SPLUNK_HOME/bin/splunk cmd btool props list --debug  | grep REPORT-ua

That should tell you which file contains the offending config item

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...