How does Splunk handle data with comma separated fields containing zero values

[Starlette]

For example

DATA test1, test2, test3

so just add the DELIMS = "," in transforms and REPORT-test entry in props.conf

REPORT-test name1,name2,name3 I expect the KV's extracted :

name1=test1 name2=test2 name3=test3

BUT what if the data looks like :

test1, "" , test3

can i expect :

name1=test1 name3=test3

OR

name1=test1 name2=test3

(not what i wanted of course)

[Lowell]

You should have no problem with missing values like this with the default delimiter-based extractions.

BTW. I'm not sure if you intended to provide your literal props.conf entry or not. But what you have shown will not work as is.

I assuming that you have the following:

transforms.conf:

[test]
DELIMS = ","
FIELDS = "name1", "name2", "name3"

props.conf

[my_source_type]
REPORT-test = test

[gkanapathy]

it will treat CSVs correctly.