Can I get outputcsv to not quote

[tkwaller]

Hello

I know this has been asked before but I retied the solution and still getting the same results.

index=java host=*myhost* name=transactional *USEmployeeUserGrpDiscountRule* "[amount=-" | dedup ticketId | rex field=_raw "\[amount=-(?<feeAdjustmentAmount>\d*\.\d*)" | eval foo="\"feeAdjustmentAmount\"" | eval boo=trim(foo, "\"") | table ticketId, boo | rename boo AS feeAdjustmentAmount

I'm sure I'm just doing something incorrectly. Its the foo eval that I don't have right.

The feeAdjustmentAmount is monetary so it will be digits.2decimals like 24.50 with no quotes in the log.

Right now, of course, the search above returns results like:

ticketId    feeAdjustmentAmount
(purposelyMasked)   feeAdjustmentAmount

Can you tell me when I outputcsv, how can I get it to exclude quotes. We use the csv to push to a webpage so fixing format is important.

Thank a bunch!

[DalJeanis]

Why are you putting the quotes there in the first place? just use

| eval foo=feeAdjustmentAmount

[tkwaller]

OK yes, that was incorrect. I removed that and used:

index=java host=*myhost* name=transactional *USEmployeeUserGrpDiscountRule* "[amount=-" | dedup ticketId | rex field=_raw "\[amount=-(?<feeAdjustmentAmount>\d*\.\d*)" | eval foo=feeAdjustmentAmount | eval boo=trim(foo, "\"") | table ticketId, boo | rename boo AS feeAdjustmentAmount | outputcsv empdiscount

but the csv is still formatted

ticketId,feeAdjustmentAmount
(purposelyMasked),"15.01"

[DalJeanis]

Try this -

 index=java host=*myhost* name=transactional *USEmployeeUserGrpDiscountRule* "[amount=-" 
| dedup ticketId 
| rex field=_raw "\[amount=-(?<feeAdjustmentAmount>\d*\.\d*)" 
| eval feeAdjustmentAmount = tonumber(feeAdjustmentAmount) 
| table ticketId, feeAdjustmentAmount 
| outputcsv empdiscount

[tkwaller]

Here are the results from that
[me@myhost ~]# cat empdiscount.csv
ticketId,feeAdjustmentAmount
(purposelymasked),"6.00"
(purposelymasked),"12.00"
(purposelymasked),"15.01"
(purposelymasked),"11.73"

Still quoted