Splunk Search

Delims not honoring quoted commas

bobbyfaber
Explorer

Is there any way to 'force' delims/fields to honor a comma within quotes in a csv file? Is this a bug?

Data is:

> "sometime","like","this"
> "other","like,um","this"

Props is:

> [my]
>     NO_BINARY_CHECK = 1
>     pulldown_type = 1
>     SHOULD_LINEMERGE=false
>     KV_MODE=none
>     REPORT-my = my_csv

Transforms is:

[my_csv] 
DELIMS = "," 
FIELDS = "one","two","three"
Tags (2)
0 Karma
1 Solution

lguinn2
Legend

Your field names should not have quotation marks. transforms.conf should be

[my_csv] 
DELIMS = "," 
FIELDS = one,two,three

See if that helps. FYI, field names can contain only letters, numbers and underscores (_), and must begin with a letter.

View solution in original post

0 Karma

lguinn2
Legend

Your field names should not have quotation marks. transforms.conf should be

[my_csv] 
DELIMS = "," 
FIELDS = one,two,three

See if that helps. FYI, field names can contain only letters, numbers and underscores (_), and must begin with a letter.

0 Karma

skirktnsi
New Member

I don't think this answers the original poster's question. The OP wanted to know if and how Splunk treats values which have embedded delimiter in them
such as

value1, value2, "value3a, value3b", value4

The OP would like to read the entire "value3a, value3b" as one field value.

0 Karma

pkliewer
New Member

^ this. Is there a clear regex way to do this?

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...