outputcsv not putting all results in quotes

Path Finder

I have a fairly complicated set of searches to create reports for Nessus vulnerability data. One thing I notice is that when I output the results to csv using outputcsv, not all of the columns are ending up in quotes. This is what the header row looks like:


The problem is that I can't import the data into Excel because some of the fields that aren't in quotes have commas in them. As far as how those fields were generated:

hostname and domainname were created from a lookup table that took the output of the Nessus plugin for resolving host names and extracting the hostname and domainname from the FQDN.

The protocol and port fields are extracted using rex at search time, but for some reason protocol isn't in quotes and port is.

Risk is extracted from the Nessus plugin files using props/transforms.conf.

The score field is assigned to the search result using a lookup table.

So, we've got several different fields that are created using several different methods, but only some of them are missing quotes.

How do I go about troubleshooting this?



Tags (1)

Super Champion

All of the quoted fields have underscores, which are often created by splunk because it converts spaces to underscores. If you change your output to AS something without a space or underscore the quotes might go away.

Excel will import the example given as csv, but some fields will have quotes.

0 Karma


Craig, did you ever got a resolution to your issue? My issue is similar but it is the opposite; I would like to know if Splunk can strip off the quotes thru some command or some parameters of outputcsv because the system the i am sending the output csv file does not like qoutes


Get Updates on the Splunk Community!

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...