CSV format difference between e-mail and output

[CerielTjuh]

Hi there,

I have noticed a difference in format between the csv files generated by Splunk when e-mail the results or saving them using the outputcsv function. If I export the results to e-mail the multiline Windows events are processed as a single field with \n for new lines.

When I export the results into a field the multilines are preserved and I cannot use the csv fields in an excel sheet since Excel sees them as multiple lines. First of all did anyone notice this as well and second (even more important 🙂 ) how can i change this so that the outputcsv function works the same as the e-mail function?

Second question, could anyone tell me if it is possible to change the names of the csv files stored by the outputcsv function?

Thank you in advance!

[cfergus]

Although this isn't a great answer, I have had the same problem in using output_mode=csv. Basically, my search had to remove a problem field:

curl -u xxx:yyy https://server:8089/services/search/jobs -d"search=search * | head 100 | fields - _si"

And to get the results:

curl -o ./myOutput.csv -u xxx:yyy 'https://server:8089/services/search/jobs/<sid>/results?output_mode=csv'

I don't know what the "_si" field is, but it's value has been something like "indexer-name\nindex". We are not using a summary index, so that shouldn't be the case.

I would use this as data points for a 'better csv output' support ticket.