Getting Data In

Data including double quotation mark processed by Splunk.

hanawa
New Member

I’m writing to ask how to process data including double quotation mark.

When I process data including double quotation mark as TSV file, I see unintended consequences as below.

Column1 AAA
Column2 B"BB
Column3 CCC
Column4 DD"D
Column5 EEE

Column1 AAA
Column2 B"BB CCC DD"D
Column3 EEE
Column4
Column5

Could you please tell me the way to not see double quotation as special character or to clear the quotation?

Tags (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Try putting FIELD_QUOTE= (no value) in the appropriate props.conf stanza.

---
If this reply helps you, Karma would be appreciated.
0 Karma

hanawa
New Member

Thanks.

An error occurred.

04-09-2017 00:09:09.141 +0900 ERROR IndexedExtractionsConfig - Error configuring indexed extracions: Invalid value='' for parameter='FIELD_QUOTE', must be at least one character., disabling them

I made the following settings.

TRUNCATE = 25000
KV_MODE = none
TIME_PREFIX = ^([^\t]*\t){11}
TIME_FORMAT = %s
SHOULD_LINEMERGE = true
MUST_NOT_BREAK_AFTER = [^ENDENDEND]$
MUST_BREAK_AFTER = ENDENDEND$
REPORT-ALARMMGR = REPORT-ALARMMGR
FIELD_QUOTE =

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Interesting. Try setting FIELD_QUOTE to a character that doesn't appear in your input. Perhaps '~'.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...