topic Re: Download results a CVS file properly with column values instead of rows! in Splunk Search

Download results a CVS file properly with column values instead of rows!

andres91302 — Fri, 26 Mar 2021 01:51:01 GMT

hello guys.. I am having a HUGE trouble when downloading my results as a CVS file.

this is my query

| search ....
| table A B C

I see on Splunk that the results are shown as 3 colummns with its values in vertical fashion... like this

A	B	C
1	5	9
2	6	7
3	8	10

but when I download these results as a cvs file and I open it The results are shown in this weird manner:

(IN THE FIRST row which is ok) A,B,C
( the second row) 1 2 3 4 5 67 9 7 10

which is not ok... can someone please help me thank you so much!!!!!! so so much

Re: Download results a CVS file properly with column values instead of rows!

493669 — Fri, 26 Mar 2021 06:21:35 GMT

@andres91302
Please try opening downloaded csv file in Microsoft excel to see results in tabular format.

If this reply helps an upvote will be appreciated!

Re: Download results a CVS file properly with column values instead of rows!

isoutamo — Fri, 26 Mar 2021 06:24:33 GMT

Are you sure that those values are individual. Based on your CSV export it seems to be one row with three elements which are multivalve elements not there rows with single values in each element.

r. Ismo

Re: Download results a CVS file properly with column values instead of rows!

andres91302 — Sat, 27 Mar 2021 02:34:09 GMT

Hi @isoutamo thank you for taking the time to reply--- yes they are in fact one row with multivalues, is there a way to have this three columns shown or downloaded as a table format where eache value is stored in in cell? for further reference my results come from the following commands: | makemv delim="," ID_SUGGAR | makemv delim="," ID_DOUBLE | eval IDS=mvmap(ID_SUGGAR,if(isnull(mvfind(ID_DOUBLE,ID_SUGGAR)),ID_SUGGAR,null())) thank you much sir

Re: Download results a CVS file properly with column values instead of rows!

isoutamo — Mon, 29 Mar 2021 06:26:01 GMT

You could try like this

r. Ismo