OUTPUTCSV file extension "csv" not applied to one of my searches.

[r999]

This seems strange, I have 2 searches which produce a simple table of results. i have added the following to the end of the saved search.

| outputcsv "metrics/metrics_data1_feed"
| outputcsv "metrics/metrics_data2_feed"

However, one of the reports does not add the file extension ".csv"

Files create:

/apps/splunk/var/run/splunk/metrics/metrics_data1_feed
/apps/splunk/var/run/splunk/metrics/metrics_data2_feed.csv

What is going on?

Do I just need to change command to
| outputcsv "metrics/metrics_data1_feed.csv"
| outputcsv "metrics/metrics_data2_feed.csv"

[iamthecat32]

Does anyone have an answer to this?

I also am having this same problem. From what I can tell the extension is being written depending on the number of results sent to the csv file. The larger the number of results, the more likely you won't have the .csv extension.

Can someone confirm this, discuss a work-around?

😞

[cedarcrestone]

I am experiencing this same issue and trying to figure it out as well. What is the max number of events that can be written to a csv file?