topic Adding tab character \t to a string in Splunk Search

Adding tab character \t to a string

paramagurukarth — Mon, 21 Feb 2022 08:07:21 GMT

I am trying to export data from splunk using splukCLI as given here

splunk search "index=_internal earliest=09/14/2015:23:59:00 latest=09/16/2015:01:00:00 " -output rawdata -maxout 200000 > c:/test123.dmp

Just want to print event fields seperated by tab character instaed of '\t' as string

tried something like

...eval _raw=field1 + "<tabchar_copied_from_notpad>" + field2 + ...

Results in improper character whcih behaves differently in different OS

and

...eval _raw=field1 + "\t" + field2 + ...

Results in "\t" avaiable in _raw as regular two characters.. not as a single tab character
Any cleaner way to achieve it

Re: Adding tab character \t to a string

tshah-splunk — Mon, 21 Feb 2022 09:24:39 GMT

Hey @paramagurukarth,

I think you can achieve that in a better way if the results are exported in CSV or JSON or XML format. It would be quite simpler to separate the fields based on delimiter instead of tab characters. If there is any specific use case or reason for exporting the data into rawdata format, please feel free to share the details.

Re: Adding tab character \t to a string

paramagurukarth — Mon, 21 Feb 2022 09:44:12 GMT

I am just trying to feed data into another repoerting solution that uses fielbeat. That monitors log files. Plan is to feed the exported content to filebeat