Getting Data In

What is the syntax to configure DELIMS= in transforms.conf for line breaking?

hagjos43
Contributor

I'm ingesting a custom sourcetype (output from a powershell script). Within the transforms.conf, how do I set the DELIMS=linebreak? I see that it can be done, but I cannot find the syntax to do so. Essentially I'm asking what is the value I need to place after the DELIMS= to accomplish this?

Many thanks!

0 Karma

alanden_splunk
Splunk Employee
Splunk Employee

I know this is an old question, but the audience should be asking whether the purpose is to extract fields with a transforms DELIMS configuration, or to separate each line to a separate event as the LINE_BREAKER =([ \r\n ]+) setting in the answer below suggests.

0 Karma

stephane_cyrill
Builder

Hi here is an example of usage:

props.conf:

[your_data_sourcetype ]
SHOULD_LINEMERGE = false
LINE_BREAKER =([ \r\n ]+)
REPORT - delims= commalist

transforms.conf:

[commalist ]
DELIMS = ","
FIELDS = field1 , field2 , field3 ,
...

you can also use in your props.conf options like:

LINE_BREAKER =..... 
SHOULD_LINEMERGE = false 
BREAK_ONLY_BEFORE = .....
MUST_BREAK_AFTER = .....
FIELD_DELIMITER =...

alanden_splunk
Splunk Employee
Splunk Employee

this separates lines into events, which may not be what is being asked, since DELIMS is used to do field extractions in transforms.conf.

0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Wednesday, May 29, 2024  |  11AM PST / 2PM ESTRegister now and join us to learn more about how you can ...

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer Certification at ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...