Splunk Enterprise
Highlighted

What does this error mean? "Failed to properly initialize the key-value parser for transform_name 'REPORT-ua'. You must define least one delimiter."

New Member

What does this error mean?

Failed to properly initialize the key-value parser for transform_name 'REPORT-ua'. You must define least one delimiter.

Somebody on my team hosed our Splunk Light instance which is throwing this error. How do I remedy this?

0 Karma
Highlighted

Re: What does this error mean? "Failed to properly initialize the key-value parser for transform_name 'REPORT-ua'. You must define least one delimiter."

Influencer

The error means your props.conf or transforms.conf has an error in it. Can you post the offending stanzas here? If you're not sure where the config files are try

$SPLUNK_HOME/bin/splunk cmd btool props list --debug  | grep REPORT-ua

That should tell you which file contains the offending config item

0 Karma
Highlighted

Re: What does this error mean? "Failed to properly initialize the key-value parser for transform_name 'REPORT-ua'. You must define least one delimiter."

Path Finder

I extracted a new valus using separated values extraction and I had the same problem :
Failed to properly initialize the key-value parser for transform_name 'REPORT-.....'. You must define least one delimiter.

Command $SPLUNK_HOME/bin/splunk cmd btool props list --debug | grep REPORT-....
doesn't return any result. Any idea?

0 Karma
Highlighted

Re: What does this error mean? "Failed to properly initialize the key-value parser for transform_name 'REPORT-ua'. You must define least one delimiter."

Path Finder

Solution good for me : changed [REPORT-SYSTEM] DELIMS = "\"" instead of [REPORT-SYSTEM] DELIMS = """ IN

        /opt/splunk/etc/users/admin/search/local/transforms.conf

same result con be achieved typeing \" directly in console during field extraction insteaad of ".

0 Karma