Is there any way to 'force' delims/fields to honor a comma within quotes in a csv file? Is this a bug?
Data is:
> "sometime","like","this"
> "other","like,um","this"
Props is:
> [my]
> NO_BINARY_CHECK = 1
> pulldown_type = 1
> SHOULD_LINEMERGE=false
> KV_MODE=none
> REPORT-my = my_csv
Transforms is:
[my_csv]
DELIMS = ","
FIELDS = "one","two","three"
Your field names should not have quotation marks. transforms.conf
should be
[my_csv]
DELIMS = ","
FIELDS = one,two,three
See if that helps. FYI, field names can contain only letters, numbers and underscores (_), and must begin with a letter.
Your field names should not have quotation marks. transforms.conf
should be
[my_csv]
DELIMS = ","
FIELDS = one,two,three
See if that helps. FYI, field names can contain only letters, numbers and underscores (_), and must begin with a letter.
I don't think this answers the original poster's question. The OP wanted to know if and how Splunk treats values which have embedded delimiter in them
such as
value1, value2, "value3a, value3b", value4
The OP would like to read the entire "value3a, value3b" as one field value.
^ this. Is there a clear regex way to do this?