Splunk Enterprise

How to export Splunk data to CSV file using Javascript

ND
Path Finder

Hi All,

I am using Javascript file to export splunk data from dashboard to CSV file.

Issue I am facing is : for few records where strings are long , data is breaking into next line.

I want to wrap those long strings in  " " to stop breaking data to next line. below is my code.

could someone please help me to get expected result

$('#exportBtn').on('click',function(e){
var searchObj= mvc.components.getInstance("rrc_main");
var myResults = searchObj.data('results',{
output_mode : 'json_rows',
count:0
});
myResults.on("data",function(){
if(myResults.hasData()){
var data= myResults.data().fields.tostring().replace("Edit,","");
var rows = myresults.data().rows;
$.each(rows, function(row){

data = data+ "\n";
for(var i=0; i< 53; i++){
if(rows[row][i]==="edit"){
continue;
}
if(rows[row][i]== null){
data= data +"\"\",";
}else{
data = data +"\""+ rows[row][i].tostring()+"\",";
}
}
});

Kindly help to wrap long strings in  " "  to read csv in proper format without breaking long strings in next line.

Appreciate your help!

 

thanks,

ND

Labels (1)
Tags (2)
0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@ND 

Can you please share some sample data from `rrc_main` search manager and the expected CSV output from those samples. It would be really helpful to understand your requirements and the issue.

 

KV

 

0 Karma

VatsalJagani
Champion

@ND - I don't long strings could create any problems with CSV. 

Though there could be an issue where your string/field-value itself has a newline character (\n) in it. You can try replacing below line into your code

data = data +"\""+ rows[row][i].tostring()+"\",";

with

data = data +"\""+ rows[row][i].tostring().replace("\n","\\n")+"\",";


Please make sure you are reading the CSV file without wrapping it in a text editor, or try reading it in Excel.

 

I hope this helps!!!

0 Karma

ND
Path Finder

Hi @VatsalJagani 

 

there is no new line \n character or not even " in between string still that long string is breaking  into new line.

kindly suggest on this.

 

thanks,

Neha

0 Karma

VatsalJagani
Champion

@ND - Generally Splunk should not do anything like that.

What is the usual length of those strings?

0 Karma

ND
Path Finder

@VatsalJagani string has more than 600 characters 

0 Karma

VatsalJagani
Champion

I don't think Splunk is creating any problem. Because as such there is no limit or behavior of Splunk doing a funky things. Please check how you are reading the files.

https://community.splunk.com/t5/Splunk-Search/What-is-the-permissible-field-value-length/m-p/517236

 

0 Karma
Get Updates on the Splunk Community!

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...

Ready, Set, SOAR: How Utility Apps Can Up Level Your Playbooks!

 WATCH NOW Powering your capabilities has never been so easy with ready-made Splunk® SOAR Utility Apps. Parse ...

DevSecOps: Why You Should Care and How To Get Started

 WATCH NOW In this Tech Talk we will talk about what people mean by DevSecOps and deep dive into the different ...