Splunk Search

How does Splunk handle data with comma separated fields containing zero values

Starlette
Contributor

For example

DATA test1, test2, test3

so just add the DELIMS = "," in transforms and REPORT-test entry in props.conf

REPORT-test name1,name2,name3 I expect the KV's extracted :

name1=test1 name2=test2 name3=test3

BUT what if the data looks like :

test1, "" , test3

can i expect :

name1=test1 name3=test3

OR

name1=test1 name2=test3

(not what i wanted of course)

Tags (2)
0 Karma

Lowell
Super Champion

You should have no problem with missing values like this with the default delimiter-based extractions.

BTW. I'm not sure if you intended to provide your literal props.conf entry or not. But what you have shown will not work as is.

I assuming that you have the following:

transforms.conf:

[test]
DELIMS = ","
FIELDS = "name1", "name2", "name3"

props.conf

[my_source_type]
REPORT-test = test

gkanapathy
Splunk Employee
Splunk Employee

it will treat CSVs correctly.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...