Excel CSV/TSV Export

[JensT]

Hi,

we have records with multiline fields.
If you do an CSV-export, MS Excel struggles as the export is really comma-separated.
Excel can only handle semicolon- or tab-separated values.

The Splunk Python Modules are already capable to do "Excel-CSV".

How and where can we tell Splunk to export "Excel-CSV"?

Regards,

Jens

[dominiquevocat]

Maybe this helps? https://splunkbase.splunk.com/app/1832/ ?

[araitz · Accepted solution]

See the Excel Export app:

http://splunk-base.splunk.com/apps/29336/splunk-for-excel-export

[iamarkaprabha]

Hi Araitz,

I have installed the addon i version 6.6.6 but the addon is not working as per the functionality

[dominiquevocat]

i can not say much as per araitz' work but maybe https://splunkbase.splunk.com/app/1832/ is of some use to you?

[frink]

I may not be taking the same path you are, but when I "Export results" from search in the UI and save it as CSV, Excel 2007 doesn't have any problem opening the file even though the _raw data I have is multiline.

When I try to run the CSV file through the text import wizard, it doesn't handle the multiline fields well. It treats every newline in the file as a new row in the Excel file. What I found was the only way to get multiline CSV values into Excel was to open the file directly into Excel. Text import didn't handle the multiline fields for me.

[JensT]

Hi,

we're using Office 2003 and Splunk 4.1.7

The search is like:

• | table a, b ,c

a and b are multiline.

When opening it directly in excel, for each newline in the field a new row is created in excel.

Regards,

HJens

[JSapienza]

Actually Excel can handle just about any delimiter if you use the "Text import Wizard". I use this feature quite often. This link might help :
http://office.microsoft.com/en-us/excel-help/text-import-wizard-HP010102244.aspx

[JensT]

Hi,

The _raw event is fine.
We're using Splunk 4.1.7.
Thanks for the hint, i will keep it in mind when we upgrade to 4.2

• Jens

[JSapienza]

Then you might need to look at how the events are being indexed. It's possible the event boundaries are not correct. Just a guess, without seeing your data, you might have to edit the props.conf for this sourcetype to correct line breaking on multi-line events. http://www.splunk.com/base/Documentation/4.2.1/Data/Indexmulti-lineevents

[JensT]

Hi,

thanks for the quick answer.
This would work, if the fields were not multiline.

The main reason is the inconvenience for the user.

Goal is that the export can directly opened in MS Excel.

• Jens