Splunk Search

how to parse a semicolon separated file for a lookup file

SplunkDank
New Member

I have a semicolon separated file that is to be used as a lookup file. How do you parse the file within the transforms.conf? I tried the DELIMS and FIELDS but no luck. I also tried to do the REGEX, and no luck.

Tags (1)
0 Karma

lydiapal_splunk
Splunk Employee
Splunk Employee

If there is anybody still looking at finding an alternative for using commas in a csv lookup file, because they CAN'T use commas, because their fields contain commas, GOOD NEWS:
You can use quotes as text delimiters and commas as field delimiters in the following fashion:

"field1","field2"
"example1,  that contains commas","something"
"example2",""
"","example3"

Splunk correctly extracts field value pairs!

0 Karma

lguinn2
Legend

Only CSV files can be used for lookups. You will need to write a script to convert the file from semi-colon separated to CSV. Or perhaps use a manual tool to convert the file to CSV (for example, Microsoft Excel can import data with arbitrary delimiters).

Run the script and write the resulting CSV file to the lookups directory in the appropriate app.
Then put the settings in the transforms.conf in the local directory of the same app.
Only these settings apply to lookups tables:http://docs.splunk.com/Documentation/Splunk/latest/Admin/Transformsconf#Lookup_tables

DELIMS, FIELDS and REGEX are transformations that are applied to events as they are parsed and indexed. These settings do not apply to lookup tables.

0 Karma

niketn
Legend

Can you add sample data, does it have header column? Are you planning to upload the file to index or lookup?

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

bheemireddi
Communicator

How does your props and transforms look?

0 Karma

niketn
Legend

@bheemireddi, converted your post to comment, since it is a follow up question, not the answer to the question being asked.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...