Reporting

Can I get outputcsv to not quote

tkwaller
Builder

Hello

I know this has been asked before but I retied the solution and still getting the same results.

index=java host=*myhost* name=transactional *USEmployeeUserGrpDiscountRule* "[amount=-" | dedup ticketId | rex field=_raw "\[amount=-(?<feeAdjustmentAmount>\d*\.\d*)" | eval foo="\"feeAdjustmentAmount\"" | eval boo=trim(foo, "\"") | table ticketId, boo | rename boo AS feeAdjustmentAmount

I'm sure I'm just doing something incorrectly. Its the foo eval that I don't have right.

The feeAdjustmentAmount is monetary so it will be digits.2decimals like 24.50 with no quotes in the log.

Right now, of course, the search above returns results like:

ticketId    feeAdjustmentAmount
(purposelyMasked)   feeAdjustmentAmount

Can you tell me when I outputcsv, how can I get it to exclude quotes. We use the csv to push to a webpage so fixing format is important.

Thank a bunch!

0 Karma

DalJeanis
Legend

Why are you putting the quotes there in the first place? just use

| eval foo=feeAdjustmentAmount

0 Karma

tkwaller
Builder

OK yes, that was incorrect. I removed that and used:

index=java host=*myhost* name=transactional *USEmployeeUserGrpDiscountRule* "[amount=-" | dedup ticketId | rex field=_raw "\[amount=-(?<feeAdjustmentAmount>\d*\.\d*)" | eval foo=feeAdjustmentAmount | eval boo=trim(foo, "\"") | table ticketId, boo | rename boo AS feeAdjustmentAmount | outputcsv empdiscount

but the csv is still formatted

ticketId,feeAdjustmentAmount
(purposelyMasked),"15.01"

0 Karma

DalJeanis
Legend

Try this -

 index=java host=*myhost* name=transactional *USEmployeeUserGrpDiscountRule* "[amount=-" 
| dedup ticketId 
| rex field=_raw "\[amount=-(?<feeAdjustmentAmount>\d*\.\d*)" 
| eval feeAdjustmentAmount = tonumber(feeAdjustmentAmount) 
| table ticketId, feeAdjustmentAmount 
| outputcsv empdiscount
0 Karma

tkwaller
Builder

Here are the results from that
[me@myhost ~]# cat empdiscount.csv
ticketId,feeAdjustmentAmount
(purposelymasked),"6.00"
(purposelymasked),"12.00"
(purposelymasked),"15.01"
(purposelymasked),"11.73"

Still quoted

0 Karma
Get Updates on the Splunk Community!

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud  In today’s fast-paced digital ...

Observability protocols to know about

Observability protocols define the specifications or formats for collecting, encoding, transporting, and ...

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...