I have a semicolon separated file that is to be used as a lookup file. How do you parse the file within the transforms.conf? I tried the DELIMS and FIELDS but no luck. I also tried to do the REGEX, and no luck.
If there is anybody still looking at finding an alternative for using commas in a csv lookup file, because they CAN'T use commas, because their fields contain commas, GOOD NEWS:
You can use quotes as text delimiters and commas as field delimiters in the following fashion:
"field1","field2"
"example1, that contains commas","something"
"example2",""
"","example3"
Splunk correctly extracts field value pairs!
Only CSV files can be used for lookups. You will need to write a script to convert the file from semi-colon separated to CSV. Or perhaps use a manual tool to convert the file to CSV (for example, Microsoft Excel can import data with arbitrary delimiters).
Run the script and write the resulting CSV file to the lookups directory in the appropriate app.
Then put the settings in the transforms.conf in the local directory of the same app.
Only these settings apply to lookups tables:http://docs.splunk.com/Documentation/Splunk/latest/Admin/Transformsconf#Lookup_tables
DELIMS, FIELDS and REGEX are transformations that are applied to events as they are parsed and indexed. These settings do not apply to lookup tables.
Can you add sample data, does it have header column? Are you planning to upload the file to index or lookup?
How does your props and transforms look?
@bheemireddi, converted your post to comment, since it is a follow up question, not the answer to the question being asked.