Splunk Search

How does Splunk handle data with comma separated fields containing zero values

Starlette
Contributor

For example

DATA test1, test2, test3

so just add the DELIMS = "," in transforms and REPORT-test entry in props.conf

REPORT-test name1,name2,name3 I expect the KV's extracted :

name1=test1 name2=test2 name3=test3

BUT what if the data looks like :

test1, "" , test3

can i expect :

name1=test1 name3=test3

OR

name1=test1 name2=test3

(not what i wanted of course)

Tags (2)
0 Karma

Lowell
Super Champion

You should have no problem with missing values like this with the default delimiter-based extractions.

BTW. I'm not sure if you intended to provide your literal props.conf entry or not. But what you have shown will not work as is.

I assuming that you have the following:

transforms.conf:

[test]
DELIMS = ","
FIELDS = "name1", "name2", "name3"

props.conf

[my_source_type]
REPORT-test = test

gkanapathy
Splunk Employee
Splunk Employee

it will treat CSVs correctly.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...