Hi there,
I have noticed a difference in format between the csv files generated by Splunk when e-mail the results or saving them using the outputcsv function. If I export the results to e-mail the multiline Windows events are processed as a single field with \n for new lines.
When I export the results into a field the multilines are preserved and I cannot use the csv fields in an excel sheet since Excel sees them as multiple lines. First of all did anyone notice this as well and second (even more important 🙂 ) how can i change this so that the outputcsv function works the same as the e-mail function?
Second question, could anyone tell me if it is possible to change the names of the csv files stored by the outputcsv function?
Thank you in advance!
Although this isn't a great answer, I have had the same problem in using output_mode=csv. Basically, my search had to remove a problem field:
curl -u xxx:yyy https://server:8089/services/search/jobs -d"search=search * | head 100 | fields - _si"
And to get the results:
curl -o ./myOutput.csv -u xxx:yyy 'https://server:8089/services/search/jobs/<sid>/results?output_mode=csv'
I don't know what the "_si" field is, but it's value has been something like "indexer-name\nindex". We are not using a summary index, so that shouldn't be the case.
I would use this as data points for a 'better csv output' support ticket.