Field extraction in cab

[lohit]

I have a csv file with following format:

105723,1614:79660877,United States,Mozilla/5.0 (Windows NT 6.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/28.0.1500.95 Safari/537.36,,2013-08-06 07:09:49.100000000,92253497

I have done the field extraction on this file delimiting on a comma(,). The problem I am facing is that one of the fields has a comma embedded in it because of which the entries are coming under different column names. Also, this type of log format is not the same in all rows of the csv file. How can I eliminate either (abcd ,efgh), i.e., whole value including the parenthesis or can I ignore the comma between the parenthesis.

[lohit]

@davecroto,kristian

I wanted to say that not in all rows(abcd,efgh) is coming. Sure entries are coming but in some fields delimeted by (;) like (abcd;efgh). I know it is a bad file genrated but this is all i have.

[kristian_kolb]

not all user-agent strings contain commas.

[davecroto]

Also, this type of log format is not the same in all rows

Not sure what you mean here. Do you mean the (abcd,efgh) is not always in the same column?

[kristian_kolb]

One way to do it would be to use SEDCMD in props.conf, by which you could remove anything within parentheses, if there is a comma there.

http://docs.splunk.com/Documentation/Splunk/latest/Admin/Propsconf

Not able to test it at the moment, but something like this ought to work as a starting point;

props.conf (on your indexer, or wherever the parsing phase takes place)

[your_sourcetype]
SEDCMD-drop_bad_comma = s/\s\([^\),]+,[^\)]+\)\s/ /g

Hope this helps,

K