How to export Splunk data to CSV file using Javascript

[ND]

Hi All,

I am using Javascript file to export splunk data from dashboard to CSV file.

Issue I am facing is : for few records where strings are long , data is breaking into next line.

I want to wrap those long strings in  " " to stop breaking data to next line. below is my code.

could someone please help me to get expected result

$('#exportBtn').on('click',function(e){
var searchObj= mvc.components.getInstance("rrc_main");
var myResults = searchObj.data('results',{
output_mode : 'json_rows',
count:0
});
myResults.on("data",function(){
if(myResults.hasData()){
var data= myResults.data().fields.tostring().replace("Edit,","");
var rows = myresults.data().rows;
$.each(rows, function(row){

data = data+ "\n";
for(var i=0; i< 53; i++){
if(rows[row][i]==="edit"){
continue;
}
if(rows[row][i]== null){
data= data +"\"\",";
}else{
data = data +"\""+ rows[row][i].tostring()+"\",";
}
}
});

Kindly help to wrap long strings in  " "  to read csv in proper format without breaking long strings in next line.

Appreciate your help!

thanks,

ND

[kamlesh_vaghela]

@ND 

Can you please share some sample data from `rrc_main` search manager and the expected CSV output from those samples. It would be really helpful to understand your requirements and the issue.

KV

[VatsalJagani]

@ND - I don't long strings could create any problems with CSV. 

Though there could be an issue where your string/field-value itself has a newline character (\n) in it. You can try replacing below line into your code

data = data +"\""+ rows[row][i].tostring()+"\",";

with

data = data +"\""+ rows[row][i].tostring().replace("\n","\\n")+"\",";

Please make sure you are reading the CSV file without wrapping it in a text editor, or try reading it in Excel.

I hope this helps!!!

[ND]

Hi @VatsalJagani 

there is no new line \n character or not even " in between string still that long string is breaking  into new line.

kindly suggest on this.

thanks,

Neha

[VatsalJagani]

@ND - Generally Splunk should not do anything like that.

What is the usual length of those strings?

[ND]

@VatsalJagani string has more than 600 characters 

[VatsalJagani]

I don't think Splunk is creating any problem. Because as such there is no limit or behavior of Splunk doing a funky things. Please check how you are reading the files.

https://community.splunk.com/t5/Splunk-Search/What-is-the-permissible-field-value-length/m-p/517236