topic Re: Change Delimeter for Export CSV in Splunk Search

Change Delimeter for Export CSV

jack_sumatra — Sat, 17 Oct 2020 17:14:48 GMT

Just a quick question. I have no experience on Splunk, but my company just use it to collect data.

My Splunk Query search :

sourcetype=st_file| fillnull clientTransactionID msisdn ocsID orderID applicationID productType providerName reponseCode responsedetail reponseMessage actiontype bNumber gatewayTransactionID | stats count as trx by _time clientTransactionID msisdn ocsID orderID applicationID productType providerName reponseCode responsedetail reponseMessage actiontype bNumber gatewayTransactionID

Then the result will be export to csv file like this :

"_time",clientTransactionID,msisdn,ocsID,orderID,applicationID,productType,providerName,reponseCode,responsedetail,reponseMessage,actiontype,bNumber,gatewayTransactionID,trx "2020-10-17T17:20:00.000+0700",023029300002187960,6281220636564,TC01,0,RBT0000,SP,RBT,2,"0|1630429199000|65","CHARGING_SUCCEEDED",F,000,"RBT0000:023029300002187960",1

Can anyone suggest me how to change delimiter from '"," to "|" on my search query?

I already read that we can change it from conf. files but since I can't get access to those files, so i have no clue here.

Thank you

Re: Change Delimeter for Export CSV

inventsekar — Sat, 17 Oct 2020 21:05:10 GMT

Hi @jack_sumatra do you get the csv file thru outputcsv command or just search results export option?

ok, the simplest idea would be, doing some post-processing methods.,

ie, after getting the csv file, you can use notepad or vi editor for linux and do "search and replace" all "," to "|"

or, do you get the csv report thru alert/report?, if so, there may be some ideas.

Re: Change Delimeter for Export CSV

jack_sumatra — Sun, 18 Oct 2020 09:16:51 GMT

I got the csv file from export option.

Thank you for the tricks, it works with small data.

But can you help me with search query to replace delimiter, because with large data results my laptop just give up to open it. 😂