Splunk Search

Delims not honoring quoted commas

bobbyfaber
Explorer

Is there any way to 'force' delims/fields to honor a comma within quotes in a csv file? Is this a bug?

Data is:

> "sometime","like","this"
> "other","like,um","this"

Props is:

> [my]
>     NO_BINARY_CHECK = 1
>     pulldown_type = 1
>     SHOULD_LINEMERGE=false
>     KV_MODE=none
>     REPORT-my = my_csv

Transforms is:

[my_csv] 
DELIMS = "," 
FIELDS = "one","two","three"
Tags (2)
0 Karma
1 Solution

lguinn2
Legend

Your field names should not have quotation marks. transforms.conf should be

[my_csv] 
DELIMS = "," 
FIELDS = one,two,three

See if that helps. FYI, field names can contain only letters, numbers and underscores (_), and must begin with a letter.

View solution in original post

0 Karma

lguinn2
Legend

Your field names should not have quotation marks. transforms.conf should be

[my_csv] 
DELIMS = "," 
FIELDS = one,two,three

See if that helps. FYI, field names can contain only letters, numbers and underscores (_), and must begin with a letter.

View solution in original post

0 Karma

skirktnsi
New Member

I don't think this answers the original poster's question. The OP wanted to know if and how Splunk treats values which have embedded delimiter in them
such as

value1, value2, "value3a, value3b", value4

The OP would like to read the entire "value3a, value3b" as one field value.

0 Karma

pkliewer
New Member

^ this. Is there a clear regex way to do this?

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.