https://community.splunk.com/t5/Splunk-Search/corrupted-CSV-results-Python-API/m-p/77387#M19547 <P>Hi,</P> <P>I'm using the Python SDK to export some search results to a CSV file, but the results seem to be somehow corrupted unless I specify an exact list of fields. So for example this:</P> <PRE><CODE>index=myindex field=pattern </CODE></PRE> <P>produces corrupted results but this</P> <PRE><CODE>index=myindex field=pattern | table field_a, field_b </CODE></PRE> <P>works just fine. The corruption looks a bit like a randomly scattered newline characters - the line suddenly ends (in the middle of a field), then there's a part of the original line missing and the remainder is on the next line. (or something like that, I'm not sure what is the exact corruption).</P> <P>The data do not contain newline characters - when exporting to JSON everything is peachy. Also there are no mixed Windows/Unix line ends (I'm on Linux).</P> Mon, 18 Jun 2012 08:55:35 GMT tomasv 2012-06-18T08:55:35Z https://community.splunk.com/t5/Splunk-Search/corrupted-CSV-results-Python-API/m-p/77387#M19547 <P>Hi,</P> <P>I'm using the Python SDK to export some search results to a CSV file, but the results seem to be somehow corrupted unless I specify an exact list of fields. So for example this:</P> <PRE><CODE>index=myindex field=pattern </CODE></PRE> <P>produces corrupted results but this</P> <PRE><CODE>index=myindex field=pattern | table field_a, field_b </CODE></PRE> <P>works just fine. The corruption looks a bit like a randomly scattered newline characters - the line suddenly ends (in the middle of a field), then there's a part of the original line missing and the remainder is on the next line. (or something like that, I'm not sure what is the exact corruption).</P> <P>The data do not contain newline characters - when exporting to JSON everything is peachy. Also there are no mixed Windows/Unix line ends (I'm on Linux).</P> Mon, 18 Jun 2012 08:55:35 GMT https://community.splunk.com/t5/Splunk-Search/corrupted-CSV-results-Python-API/m-p/77387#M19547 tomasv 2012-06-18T08:55:35Z https://community.splunk.com/t5/Splunk-Search/corrupted-CSV-results-Python-API/m-p/77388#M19548 <P>Question: I've seen JSON output and it appears to have "nice-afied" the "\n" new lines. Could you capture a CSV and XML portion and send to <A href="mailto:devinfo@splunk.com">devinfo@splunk.com</A>? </P> <P>Thanks,</P> <P>Wim</P> Fri, 06 Jul 2012 16:23:32 GMT https://community.splunk.com/t5/Splunk-Search/corrupted-CSV-results-Python-API/m-p/77388#M19548 wcolgate_splunk 2012-07-06T16:23:32Z