What does this error mean? "Failed to properly initialize the key-value parser for transform_name 'REPORT-ua'. You must define least one delimiter."

[bscavotto]

What does this error mean?

Failed to properly initialize the key-value parser for transform_name 'REPORT-ua'. You must define least one delimiter.

Somebody on my team hosed our Splunk Light instance which is throwing this error. How do I remedy this?

[fab73]

Solution good for me : changed [REPORT-SYSTEM] DELIMS = "\"" instead of [REPORT-SYSTEM] DELIMS = """ IN

        /opt/splunk/etc/users/admin/search/local/transforms.conf

same result con be achieved typeing \" directly in console during field extraction insteaad of ".

[fab73]

I extracted a new valus using separated values extraction and I had the same problem :
Failed to properly initialize the key-value parser for transform_name 'REPORT-.....'. You must define least one delimiter.

Command $SPLUNK_HOME/bin/splunk cmd btool props list --debug | grep REPORT-....
doesn't return any result. Any idea?

[jplumsdaine22]

The error means your props.conf or transforms.conf has an error in it. Can you post the offending stanzas here? If you're not sure where the config files are try

$SPLUNK_HOME/bin/splunk cmd btool props list --debug  | grep REPORT-ua

That should tell you which file contains the offending config item