Getting Data In

The exported csv file of the Splunk results is not aligned

santosh_hb
Explorer

Hi, I have exported my search results into a csv file using Export button.
The output result contains a list of Email adresses that are field values.

But, the contents of csv file looks like below:
test@test.com email@sample.com data@test.com.....

whereas I want the output as below:
test@test.com

email@sample.com

data@test.com

I am using the below query for getting the output:
stats values(EMAIL_DATA) AS COMBINED_EMAIL

Output in splunk looks like below:

COMBINED_EMAIL
test@test.com

email@sample.com

data@test.com

Kindly help me with the formatting issue.

Tags (1)
0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

Instead of stats values(EMAIL_DATA) creating a multi-value field, use stats count by EMAIL_DATA. Then use fields and/or rename to format the data however you like.

View solution in original post

0 Karma

woodcock
Esteemed Legend

Add this to the end of your search:

... | mvexpand COMBINED_EMAIL
0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Instead of stats values(EMAIL_DATA) creating a multi-value field, use stats count by EMAIL_DATA. Then use fields and/or rename to format the data however you like.

0 Karma

santosh_hb
Explorer

It works fine.

0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...