I have a report that runs and builds a output.csv, the report is ',' delimited how ever when the file is parsed by a scriopted process it produces the incorrect results because of the format of full name. Customer is asking if the report can be tab delimited. Here is the report:
index=network sourcetype=cisco:asa (message_id = 722051) | iplocation lang=code src | dedup user | eval g=trim(group,"<>") | rex field=user_email "(?.)@travelers.com" | search g=-aoe | table time, user_nick, g, user_bunit, user, u, user_work_city, user_work_country, assigned_ip, src, City, Region, Country, user_email, user_phone, user_managedBy, dvc | rename user_nick AS "User", g AS "VPN Group", user_bunit AS "Business Unit", user_work_city AS "User City", user_work_country AS "User Country", assigned_ip as "Assigned IP Address", src as "Real IP Address", user_email AS "Email", user_phone AS "Phone", user_managedBy as "Manager", dvc as "ASA", u as "Shortname", user AS "nTIC"
| outputcsv [ | stats count | eval filename=strftime(now(), "aoe%Y_%m_%d") | return $filename]
