Getting Data In

How to handle parsing of CSV files with fields containing commas?

bb2324oo
Engager

My data is parsed into CSV files with default comma delimiters.

Many fields contain one or more commas.

When I use this in props.conf:

    [your_sourcetype]
   EXTRACT-second_round = ^(?[^,]*),(?[^,]*),(?[^,]*),(?.*),(?[^,]*),(?[^,]*),(?[^,]*)

However, Commas could only be in field 4, it does not support multiple commas in fields.

Some may propose this approach:
props.conf

[your_sourcetype]
REPORT-blah = hash_delim

transforms.conf

[hash_delim]
DELIMS = "#"
FIELDS = field1, field2, field3 etc

However, I cannot find a delim which must not be in any fields.

Please help. Any suggestion?

Also, why would commas inside the double quotation marks will be considered as a delimiter in a csv?

fdi01
Motivator

try this :

[hash_delim]
DELIMS = ","
FIELDS = field1, field2, field3 etc

see this example below, Extract comma-delimited values into fields:

[extract_csv]
DELIMS = ","
FIELDS = "field1", "field2", "field3"

This example assigns the extracted values from _raw to field1, field2 and field3 (in order of extraction). If more than three values are extracted, the values without a matching field name are ignored.

Get Updates on the Splunk Community!

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Wednesday, May 29, 2024  |  11AM PST / 2PM ESTRegister now and join us to learn more about how you can ...

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer Certification at ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...

Share Your Ideas & Meet the Lantern team at .Conf! Plus All of This Month’s New ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...