Getting Data In

How to remove newline characters that show up in alert CSV but not search?


I have an alert that pulls back any updated dashboards every day and sends me an email with the attached CSV file. The XML of the dashboard is included in the results so that I can drop it into TFS.

When I run the search manually and export the results as CSV, it works as intended, but when i get the CSV file in my inbox every line of the XML has a \n character.

I'm working on trying to automate and use this for source control, so ideally i'd like the output to just have the raw XML that I can just use TFS api/executables to drop straight into the repository.

Here is my search, I believe it should work for any Splunk instance:

index=_internal sourcetype=splunkd_ui_access method=POST
| rex field=uri ".*(?<URI>\/servicesNS.*)"
| where like(URI,"%"."data/ui/views/"."%")
| join URI 
    [| rest /servicesNS/-/-/data/ui/views 
| search isDashboard=1 eai:acl.sharing="global"
| eval yesterday=strftime(relative_time(now(), "-2d"), "%Y-%m-%d")
| rex field=id "https:\/\/.*(?<URI>\/servicesNS.*)"
| where updated > yesterday]
| rename eai:appName as App, eai:data as XML
| eval filename=App."_".label
| dedup filename,updated
| table filename, updated, user, XML
| sort +updated


Have you found any solution for above mentioned Issue. I am facing the similar issue

0 Karma


I ended up using a powershell script to "clean" the data once its been, no, not really.

0 Karma


You must not have the same char encoding as Splunk (UTF8 vs ASCII, etc Linux Windows)

You could try |rex mode=sed "s/\n//g" to remove \n but if might not work every time.

Change encoding in your mail client or in props.conf

0 Karma
Get Updates on the Splunk Community!

2024 Splunk Career Impact Survey | Earn a $20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...