Splunk Search

how to parse a semicolon separated file for a lookup file

SplunkDank
New Member

I have a semicolon separated file that is to be used as a lookup file. How do you parse the file within the transforms.conf? I tried the DELIMS and FIELDS but no luck. I also tried to do the REGEX, and no luck.

Tags (1)
0 Karma

lydiapal_splunk
Splunk Employee
Splunk Employee

If there is anybody still looking at finding an alternative for using commas in a csv lookup file, because they CAN'T use commas, because their fields contain commas, GOOD NEWS:
You can use quotes as text delimiters and commas as field delimiters in the following fashion:

"field1","field2"
"example1,  that contains commas","something"
"example2",""
"","example3"

Splunk correctly extracts field value pairs!

0 Karma

lguinn2
Legend

Only CSV files can be used for lookups. You will need to write a script to convert the file from semi-colon separated to CSV. Or perhaps use a manual tool to convert the file to CSV (for example, Microsoft Excel can import data with arbitrary delimiters).

Run the script and write the resulting CSV file to the lookups directory in the appropriate app.
Then put the settings in the transforms.conf in the local directory of the same app.
Only these settings apply to lookups tables:http://docs.splunk.com/Documentation/Splunk/latest/Admin/Transformsconf#Lookup_tables

DELIMS, FIELDS and REGEX are transformations that are applied to events as they are parsed and indexed. These settings do not apply to lookup tables.

0 Karma

niketn
Legend

Can you add sample data, does it have header column? Are you planning to upload the file to index or lookup?

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

bheemireddi
Communicator

How does your props and transforms look?

0 Karma

niketn
Legend

@bheemireddi, converted your post to comment, since it is a follow up question, not the answer to the question being asked.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...