Splunk Search

Can I tab delimit a report file

pfabrizi
Path Finder

I have a report that runs and builds a output.csv, the report is ',' delimited how ever when the file is parsed by a scriopted process it produces the incorrect results because of the format of full name. Customer is asking if the report can be tab delimited. Here is the report:
index=network sourcetype=cisco:asa (message_id = 722051) | iplocation lang=code src | dedup user | eval g=trim(group,"<>") | rex field=user_email "(?.)@travelers.com" | search g=-aoe | table time, user_nick, g, user_bunit, user, u, user_work_city, user_work_country, assigned_ip, src, City, Region, Country, user_email, user_phone, user_managedBy, dvc | rename user_nick AS "User", g AS "VPN Group", user_bunit AS "Business Unit", user_work_city AS "User City", user_work_country AS "User Country", assigned_ip as "Assigned IP Address", src as "Real IP Address", user_email AS "Email", user_phone AS "Phone", user_managedBy as "Manager", dvc as "ASA", u as "Shortname", user AS "nTIC"
| outputcsv [ | stats count | eval filename=strftime(now(), "aoe
%Y_%m_%d") | return $filename]

Tags (1)
0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...