Getting Data In

How do I specify Ctrl-A (\x01) as a field delimiter in props.conf?

jimjh
Path Finder

How do I specify Ctrl-A (\u0001) as a field delimiter in props.conf?

I tried

[xxx]
FIELD_DELIMITER=\x01

[xxx]
FIELD_DELIMITER=^A

[xxx]
FIELD_DELIMITER=\u0001
Tags (2)
1 Solution

jimjh
Path Finder

Inside props.conf, use

REPORT-fields = kv_ctrl_sep

Inside transforms.conf, use

[kv_ctrl_sep]
FIELDS = x, y, z
CAN_OPTIMIZE = false
DELIMS = "

Then use python to print a \x01 character into transforms.conf

with open('transforms.conf', 'a') as f:
  f.write('\x01')

Finally, open up transforms.conf and add the closing quote.

View solution in original post

jimjh
Path Finder

Inside props.conf, use

REPORT-fields = kv_ctrl_sep

Inside transforms.conf, use

[kv_ctrl_sep]
FIELDS = x, y, z
CAN_OPTIMIZE = false
DELIMS = "

Then use python to print a \x01 character into transforms.conf

with open('transforms.conf', 'a') as f:
  f.write('\x01')

Finally, open up transforms.conf and add the closing quote.

Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...