|
I have a CSV file that lines up fields perfectly in Excel, but when Splunk parses that same CSV data, it gets tripped up when it gets an event with an extra comma in it, even if each field is encapsulated with "quotes" like this: "5/1/2012 12:15:43 AM","GeneralHostWarningEvent","warning","","USLAB1","Compute HCS","Issue detected on uslab1esxi04, reboot host." See in the last field, there is a comma before reboot host. This is where Splunk ends that field and then events after this get misaligned. Is this a bug that should be fixed, or am I going to need to backfill all my data with a force dimlimiter of some other character other than a comma? Thanks |
|
Your CSV file should work if you put the next line in your stanza in transforms.conf [Your_stanza] FIELDS="Time","EventType","Priority","somthing","location","client","description" DELIMS="," [Edit] I did some more research and found out that multiple characters to split the CSV fields is not possible. You can use an regular expression instead to split your fields. [/Edit] Thats what my stanza currently looks like.
(06 Jun '12, 08:54)
virtualpony
|
