https://community.splunk.com/t5/Alerting/scripted-alert-providing-a-results-csv-with-fields-containing/m-p/57984#M797 <P>This is because the mac_addr and ip field contain multiple values (ie. they are multivalue field). You can circumvent this by joining the multivalue fields in your search:</P> <PRE><CODE>... | eval mac_addr=mvjoin(mac_addr,", ") | eval ip=mvjoin(ip, ", ") </CODE></PRE> <P>See <A href="http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/CommonEvalFunctions">http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/CommonEvalFunctions</A></P> Wed, 23 May 2012 13:36:14 GMT ziegfried 2012-05-23T13:36:14Z https://community.splunk.com/t5/Alerting/scripted-alert-providing-a-results-csv-with-fields-containing/m-p/57983#M796 <P>My full search is as follows:</P> <PRE><CODE>index=main node_action action=added | eval ip=if(ip=="0.0.0.0",null(),ip) | eval ip_orig=ip | lookup arp mac_addr | eval ip=if(isnull(ip_orig),ip,ip_orig) | eval ip=if(ip="[UNKNOWN]","",ip) | fields - _raw | fields mac_addr ip mac_type | eval mac_addr=mvjoin(mac_addr,", ") | eval ip=mvjoin(ip, ", ") | eval node_type=mvjoin(node_type, ", ") | rename ip as ip_addr |table mac_addr ip_addr mac_type </CODE></PRE> <P>but when i unzip results.csv, I see fields with "__mv_" that I would like to exclude from my csv results:</P> <PRE><CODE>"mac_addr","__mv_mac_addr","ip_addr","__mv_ip_addr","mac_type","__mv_mac_type" </CODE></PRE> <P>Any ideas how to do that?</P> Tue, 22 May 2012 21:34:36 GMT https://community.splunk.com/t5/Alerting/scripted-alert-providing-a-results-csv-with-fields-containing/m-p/57983#M796 jaoui 2012-05-22T21:34:36Z https://community.splunk.com/t5/Alerting/scripted-alert-providing-a-results-csv-with-fields-containing/m-p/57984#M797 <P>This is because the mac_addr and ip field contain multiple values (ie. they are multivalue field). You can circumvent this by joining the multivalue fields in your search:</P> <PRE><CODE>... | eval mac_addr=mvjoin(mac_addr,", ") | eval ip=mvjoin(ip, ", ") </CODE></PRE> <P>See <A href="http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/CommonEvalFunctions">http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/CommonEvalFunctions</A></P> Wed, 23 May 2012 13:36:14 GMT https://community.splunk.com/t5/Alerting/scripted-alert-providing-a-results-csv-with-fields-containing/m-p/57984#M797 ziegfried 2012-05-23T13:36:14Z https://community.splunk.com/t5/Alerting/scripted-alert-providing-a-results-csv-with-fields-containing/m-p/57985#M798 <P>I added that to my search but it does not seem to fix my issue...</P> <P>As my search is contains too many characters, I will add it to my initial question</P> <P>in the search app, I don't see the additional fields such as "__mv_mac_addr" (even when I do "... | table *" but the results.csv contains them</P> Mon, 28 Sep 2020 11:51:37 GMT https://community.splunk.com/t5/Alerting/scripted-alert-providing-a-results-csv-with-fields-containing/m-p/57985#M798 jaoui 2020-09-28T11:51:37Z