topic Eventgen - Splunk adding additional double quotes when I export the data as csv causing issues used as sample file? in Getting Data In

Eventgen - Splunk adding additional double quotes when I export the data as csv causing issues used as sample file?

vksplunk1 — Thu, 27 Oct 2022 21:46:24 GMT

Hi ,

Splunk adding additional double quotes when I export the data as csv . When I use the exported file as eventgen sample file, it causing parsing issues used when insert events using the sample file.

Any suggestions to this issue

Re: Eventgen - Splunk adding additional double quotes when I export the data as csv causing issues used as sample file

somesoni2 — Thu, 27 Oct 2022 18:31:05 GMT

Could you please provide some examples of data in Splunk that you're exporting that is having issues?

Re: Eventgen - Splunk adding additional double quotes when I export the data as csv causing issues used as sample file

vksplunk1 — Thu, 27 Oct 2022 18:37:11 GMT

Here is part of the 1st event in the exported file:

testindex,"/opt/splunk/var/log/cdm/events/events.log","testindex:testsourcetype","1665554739.952,root_host=""test.server.domain.com"",comp_id=""1234444"",check_checklist_name=""test name"",check_disa_cki_id="""",......

Re: Eventgen - Splunk adding additional double quotes when I export the data as csv causing issues used as sample file

vksplunk1 — Thu, 27 Oct 2022 19:13:50 GMT

Here is part of the 1st event in the exported file: