Label delimeter

[Craig Merchant]

Hey, Carter.

 

Is there any way to control the delimiter used when multiple labels are applied to a source or destination?  I want to import the output of Argus into Splunk, which expects a fixed number of columns in the data to apply field names to.  Since our internal hosts have one or more labels associated with them, that makes each record have a variable number of columns.

 

I've worked around it by changing the field delimiter to "@" and then using sed to replace the label commas with pound signs and then replace the "@" sign with commas.  That process can be somewhat slow and CPU intensive over a large number of records.  It would be great if there was a way to specify a separate delimiter for the label fields.

 

Thanks.


Craig 
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://pairlist1.pair.net/pipermail/argus/attachments/20140723/c9f38b8d/attachment.html>