Getting Data In

How to handle parsing of CSV files with fields containing commas?

bb2324oo
Engager

My data is parsed into CSV files with default comma delimiters.

Many fields contain one or more commas.

When I use this in props.conf:

    [your_sourcetype]
   EXTRACT-second_round = ^(?[^,]*),(?[^,]*),(?[^,]*),(?.*),(?[^,]*),(?[^,]*),(?[^,]*)

However, Commas could only be in field 4, it does not support multiple commas in fields.

Some may propose this approach:
props.conf

[your_sourcetype]
REPORT-blah = hash_delim

transforms.conf

[hash_delim]
DELIMS = "#"
FIELDS = field1, field2, field3 etc

However, I cannot find a delim which must not be in any fields.

Please help. Any suggestion?

Also, why would commas inside the double quotation marks will be considered as a delimiter in a csv?

fdi01
Motivator

try this :

[hash_delim]
DELIMS = ","
FIELDS = field1, field2, field3 etc

see this example below, Extract comma-delimited values into fields:

[extract_csv]
DELIMS = ","
FIELDS = "field1", "field2", "field3"

This example assigns the extracted values from _raw to field1, field2 and field3 (in order of extraction). If more than three values are extracted, the values without a matching field name are ignored.

Get Updates on the Splunk Community!

Join Us for Splunk University and Get Your Bootcamp Game On!

If you know, you know! Splunk University is the vibe this summer so register today for bootcamps galore ...

.conf24 | Learning Tracks for Security, Observability, Platform, and Developers!

.conf24 is taking place at The Venetian in Las Vegas from June 11 - 14. Continue reading to learn about the ...

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...