Autoparser troubleshooting

The situation: sometimes, the structure of raw data doesn't allow the system to fully identify the pattern as intended, being unable to extend the delimiter distribution to the end of the sample. This results in the last two fields being identified as a single entity.

The solution: a possibility is to filter the table to show only the event that suit your needs. This minimizes the sample analyzed and thus refines the identified pattern, ensuring the delimiter is processed as such for the last two fields.

The situation: data contained within wrappers (i.e., "", (), [], {}, '', etc.) must be preceded and followed by delimiters. Otherwise, the table generation results in a display of null values, even though the autoparser preview appears correct and no warnings or errors are shown.

The solution: Logs must be formatted properly to ensure the autoparser generates tables correctly. If a log contains wrapped data, the wrappers must be surrounded by delimiters or be located at the start or end of the log.

The situation: Logs containing wrappers (i.e., "",(), [], {}, '', etc.) followed by delimiters must not include a closing wrapper and delimiter combination within the wrapped content (e.g., a string, "a string with one, \"two\", and three", and another string, using the comma (,) as delimiter). If they do, the autoparser misinterprets the log, splitting the field incorrectly because it assumes the end of the field has been reached.

The solution: Logs must be formatted correctly to ensure the autoparser generates tables properly.