topic Re: How Splunk admin can find a search executed by user which causing SearchResults - Corrupt csv header, 2 columns with the same name '__mv_Calling_Station_Identifier' (col #xx and #xxx, #xxx will be ignored) in Splunk Search

How Splunk admin can find a search executed by user which causing SearchResults - Corrupt csv header, 2 columns with the same name '__mv_Calling_Station_Identifier' (col #xx and #xxx, #xxx will be ignored)

anilyelmar — Tue, 29 Sep 2020 22:49:42 GMT

How Splunk admin can find a search executed by user which causing SearchResults - Corrupt csv header, 2 columns with the same name '__mv_Calling_Station_Identifier' (col #xx and #xxx, #xxx will be ignored)

Re: How Splunk admin can find a search executed by user which causing SearchResults - Corrupt csv header, 2 columns with the same name '__mv_Calling_Station_Identifier' (col #xx and #xxx, #xxx will be ignored)

dkeck — Fri, 18 Jan 2019 08:56:22 GMT

Hi,

I am not sure I get your question, but if you ask where you can find executed searches in splunkd log. then have a look at

index=_audit action="search" search=* NOT user="splunk-system-user"

also refer to

https://answers.splunk.com/answers/151378/why-history-command-only-shows-my-searches-not-searches-run-by-all-users.html

Please accept the answer if it was helpful thank you 🙂

Re: How Splunk admin can find a search executed by user which causing SearchResults - Corrupt csv header, 2 columns with the same name '__mv_Calling_Station_Identifier' (col #xx and #xxx, #xxx will be ignored)

anilyelmar — Tue, 29 Sep 2020 22:49:44 GMT

thanks , let me clarify my question: I do see a lot of errors in my search head internal logs as "SearchResults - Corrupt csv header, 2 columns with the same name '__mv_Calling_Station_Identifier' (col #xx and #xxx, #xxx will be ignored)" which means I have some users running ad-hoc/scheduled searches and resulting duplicate field names like ...|fields a b c a d b e ( here a and b are duplicated unnecessary)
I have hundreds of users running thousands of searches daily and its impossible to look manually each of them for above issue) I am looking a way to identify those users and their search strings.