Parse delimited
Parses a CSV or TSV file from a delimited text file using a delimiter. Use this function in conjunction with the File source function.
- Function Input
- collection<record<R>>
- This function takes in collections of records with schema R.
- Function Output
- collection<record<S>>
- This function outputs the same collection of records but with a different schema S.
Arguments
Argument | Input | Description | UI example |
---|---|---|---|
body | expression<string> | An expression that contains the body of the record to be parsed. | get("body"); |
field-delimiter | string | A delimiter that separates the fields in the static file. | , |
header | string | A delimited list of field header names, use the same delimiter as the field delimiter argument. | host,source |
Full DSL example
This example parses the field body with host and source headers:
parse-delimited(events, get("body"), ",", "host,source");
Normalize (projection) | Parse regex (rex) |
This documentation applies to the following versions of Splunk® Data Stream Processor: 1.0.1
Feedback submitted, thanks!