Delims not honoring quoted commas

[bobbyfaber]

Is there any way to 'force' delims/fields to honor a comma within quotes in a csv file? Is this a bug?

Data is:

> "sometime","like","this"
> "other","like,um","this"

Props is:

> [my]
>     NO_BINARY_CHECK = 1
>     pulldown_type = 1
>     SHOULD_LINEMERGE=false
>     KV_MODE=none
>     REPORT-my = my_csv

Transforms is:

[my_csv] 
DELIMS = "," 
FIELDS = "one","two","three"

[lguinn2 · Accepted solution]

Your field names should not have quotation marks. transforms.conf should be

[my_csv] 
DELIMS = "," 
FIELDS = one,two,three

See if that helps. FYI, field names can contain only letters, numbers and underscores (_), and must begin with a letter.

[skirktnsi]

I don't think this answers the original poster's question. The OP wanted to know if and how Splunk treats values which have embedded delimiter in them
such as

value1, value2, "value3a, value3b", value4

The OP would like to read the entire "value3a, value3b" as one field value.

[pkliewer]

^ this. Is there a clear regex way to do this?