Reporting

How to fix encoding of exported CSV?

vanvan
Path Finder

Hi everyone,

I have produced a search, which formats events in a table with couple of columns. The data and column names use Cyrillic words and in the GUI these look just fine. However, when I try to export the table as CSV (via the "Export To" option) the data and column names are encoded incorrectly and are not readable. 

Is there a setting which I can change so that this problem is fixed?

 

I've searched the other topics here in Communities, but didn't find an asnwer, e.g.:

https://community.splunk.com/t5/Splunk-Search/Why-are-special-characters-replaced-with-UTF-8-after-e...

https://community.splunk.com/t5/Getting-Data-In/Korean-character-is-broken-when-I-export-the-query-r... 

Any help is appreciated,

Thanks!

Labels (2)
Tags (3)
0 Karma

ivan_dzhantov
Engager

Hello @scelikok

I tested the solution you provided in your post and it worked for me. Thank you for the time you spent on researching the matter. I saved me a lot of time. 

I appreciate your willing ness to help. Have a great day. 

 

Best regards, 

Ivan

0 Karma

scelikok
SplunkTrust
SplunkTrust

Hi @vanvan,

If you see the exported CSV file readable in Notepad++/Sublime but in Excel, below fix should work for you. Excel needs BOM characters at the beginning of file to understand UTF8.

Please update readall function as below and restart Splunk service. This is for Splunk 8.0 and later.

$SPLUNK_HOME/lib/python3.7/site-packages/splunk/rest/__init__.py

def readall(self, blocksize=32768):
        """
        Returns a generator reading blocks of data from the response
        until all data has been read
        """
        response = self.response
        import codecs
        counter = 0;
        while True:
            data = response.read(blocksize)
            if not data:
                break
            if counter == 0:
                data = b"".join((codecs.BOM_UTF8, data))
                counter += 1
            yield data

 

If this reply helps you an upvote and "Accept as Solution" is appreciated.

vanvan
Path Finder

Thanks!

This is interesting, I'll try it.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...