I know how to add csv with outputcsv and also found an older command
./splunk search '*' -format normal > file-name
Valid types are: custom, normal, xml, csv, table
But this only takes a few lines...so the question is, is this possbile to get more events?
case is that I see data which is flowing on a port, and I want to extract stuff etc, but when I export I have to deal with the commas.
( I mentioned this cause maybee there is another way!)
Use the -maxout parameter. If you're monitoring on a port, you might just use real-time search parameters to keep a continuous flow of events as they come in instead
View solution in original post