Getting Data In

What is the syntax to configure DELIMS= in transforms.conf for line breaking?

hagjos43
Contributor

I'm ingesting a custom sourcetype (output from a powershell script). Within the transforms.conf, how do I set the DELIMS=linebreak? I see that it can be done, but I cannot find the syntax to do so. Essentially I'm asking what is the value I need to place after the DELIMS= to accomplish this?

Many thanks!

0 Karma

alanden_splunk
Splunk Employee
Splunk Employee

I know this is an old question, but the audience should be asking whether the purpose is to extract fields with a transforms DELIMS configuration, or to separate each line to a separate event as the LINE_BREAKER =([ \r\n ]+) setting in the answer below suggests.

0 Karma

stephane_cyrill
Builder

Hi here is an example of usage:

props.conf:

[your_data_sourcetype ]
SHOULD_LINEMERGE = false
LINE_BREAKER =([ \r\n ]+)
REPORT - delims= commalist

transforms.conf:

[commalist ]
DELIMS = ","
FIELDS = field1 , field2 , field3 ,
...

you can also use in your props.conf options like:

LINE_BREAKER =..... 
SHOULD_LINEMERGE = false 
BREAK_ONLY_BEFORE = .....
MUST_BREAK_AFTER = .....
FIELD_DELIMITER =...

alanden_splunk
Splunk Employee
Splunk Employee

this separates lines into events, which may not be what is being asked, since DELIMS is used to do field extractions in transforms.conf.

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

REGISTER NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If ...

Observability | Use Synthetic Monitoring for Website Metadata Verification

If you are on Splunk Observability Cloud, you may already have Synthetic Monitoringin your observability ...

More Ways To Control Your Costs With Archived Metrics | Register for Tech Talk

Tuesday, May 14, 2024  |  11AM PT / 2PM ET Register to Attend Join us for this Tech Talk and learn how to ...