Activity Feed
- Posted Re: Data including double quotation mark processed by Splunk. on Getting Data In. 04-05-2017 03:58 AM
- Posted Data including double quotation mark processed by Splunk. on Getting Data In. 04-03-2017 11:00 PM
- Tagged Data including double quotation mark processed by Splunk. on Getting Data In. 04-03-2017 11:00 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 |
04-05-2017
03:58 AM
Thanks.
An error occurred.
04-09-2017 00:09:09.141 +0900 ERROR IndexedExtractionsConfig - Error configuring indexed extracions: Invalid value='' for parameter='FIELD_QUOTE', must be at least one character., disabling them
I made the following settings.
TRUNCATE = 25000
KV_MODE = none
TIME_PREFIX = ^([^\t]*\t){11}
TIME_FORMAT = %s
SHOULD_LINEMERGE = true
MUST_NOT_BREAK_AFTER = [^ENDENDEND]$
MUST_BREAK_AFTER = ENDENDEND$
REPORT-ALARMMGR = REPORT-ALARMMGR
FIELD_QUOTE =
... View more
04-03-2017
11:00 PM
I’m writing to ask how to process data including double quotation mark.
When I process data including double quotation mark as TSV file, I see unintended consequences as below.
Column1 AAA
Column2 B"BB
Column3 CCC
Column4 DD"D
Column5 EEE
Column1 AAA
Column2 B"BB CCC DD"D
Column3 EEE
Column4
Column5
Could you please tell me the way to not see double quotation as special character or to clear the quotation?
... View more
- Tags:
- splunk-enterprise
