Splunk Search

How does Splunk handle data with comma separated fields containing zero values


For example

DATA test1, test2, test3

so just add the DELIMS = "," in transforms and REPORT-test entry in props.conf

REPORT-test name1,name2,name3 I expect the KV's extracted :

name1=test1 name2=test2 name3=test3

BUT what if the data looks like :

test1, "" , test3

can i expect :

name1=test1 name3=test3


name1=test1 name2=test3

(not what i wanted of course)

Tags (2)
0 Karma

Super Champion

You should have no problem with missing values like this with the default delimiter-based extractions.

BTW. I'm not sure if you intended to provide your literal props.conf entry or not. But what you have shown will not work as is.

I assuming that you have the following:


DELIMS = ","
FIELDS = "name1", "name2", "name3"


REPORT-test = test

Splunk Employee
Splunk Employee

it will treat CSVs correctly.

0 Karma
Get Updates on the Splunk Community!

Streamline Data Ingestion With Deployment Server Essentials

REGISTER NOW!Every day the list of sources Admins are responsible for gets bigger and bigger, often making the ...

Remediate Threats Faster and Simplify Investigations With Splunk Enterprise Security ...

REGISTER NOW!Join us for a Tech Talk around our latest release of Splunk Enterprise Security 7.2! We’ll walk ...

Introduction to Splunk AI

WATCH NOWHow are you using AI in Splunk? Whether you see AI as a threat or opportunity, AI is here to stay. ...