Reporting
Highlighted

OUTPUTCSV file extension "csv" not applied to one of my searches.

Path Finder

This seems strange, I have 2 searches which produce a simple table of results. i have added the following to the end of the saved search.

| outputcsv "metrics/metrics_data1_feed"
| outputcsv "metrics/metrics_data2_feed"

However, one of the reports does not add the file extension ".csv"

Files create:

/apps/splunk/var/run/splunk/metrics/metrics_data1_feed
/apps/splunk/var/run/splunk/metrics/metrics_data2_feed.csv

What is going on?

Do I just need to change command to
| outputcsv "metrics/metricsdata1feed.csv"
| outputcsv "metrics/metricsdata2feed.csv"

Tags (1)
0 Karma
Highlighted

Re: OUTPUTCSV file extension "csv" not applied to one of my searches.

New Member

Does anyone have an answer to this?

I also am having this same problem. From what I can tell the extension is being written depending on the number of results sent to the csv file. The larger the number of results, the more likely you won't have the .csv extension.

Can someone confirm this, discuss a work-around?

😞

0 Karma
Highlighted

Re: OUTPUTCSV file extension "csv" not applied to one of my searches.

Explorer

I am experiencing this same issue and trying to figure it out as well. What is the max number of events that can be written to a csv file?

0 Karma