Getting Data In

CSV format difference between e-mail and output

Path Finder

Hi there,

I have noticed a difference in format between the csv files generated by Splunk when e-mail the results or saving them using the outputcsv function. If I export the results to e-mail the multiline Windows events are processed as a single field with \n for new lines.

When I export the results into a field the multilines are preserved and I cannot use the csv fields in an excel sheet since Excel sees them as multiple lines. First of all did anyone notice this as well and second (even more important 🙂 ) how can i change this so that the outputcsv function works the same as the e-mail function?

Second question, could anyone tell me if it is possible to change the names of the csv files stored by the outputcsv function?

Thank you in advance!

Tags (3)

Path Finder

Although this isn't a great answer, I have had the same problem in using output_mode=csv. Basically, my search had to remove a problem field:

curl -u xxx:yyy https://server:8089/services/search/jobs -d"search=search * | head 100 | fields - _si"

And to get the results:

curl -o ./myOutput.csv -u xxx:yyy 'https://server:8089/services/search/jobs/<sid>/results?output_mode=csv'

I don't know what the "_si" field is, but it's value has been something like "indexer-name\nindex". We are not using a summary index, so that shouldn't be the case.

I would use this as data points for a 'better csv output' support ticket.

0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...