Download results a CVS file properly with column values instead of rows!

[andres91302]

hello guys.. I am having a HUGE trouble when downloading my results as a CVS file.

this is my query

| search ....
| table A B C

I see on Splunk that the results are shown as 3 colummns with its values in vertical fashion... like this

A	B	C
1	5	9
2	6	7
3	8	10

but when I download these results as a cvs file and I open it The results are shown in this weird manner:


    (IN THE FIRST row which is ok)     A,B,C                                                                   
               ( the second row)                     1 2 3 4 5 67 9 7 10

which is not ok... can someone please help me thank you so much!!!!!! so so much

[isoutamo]

Are you sure that those values are individual. Based on your CSV export it seems to be one row with three elements which are multivalve elements not there rows with single values in each element.

r. Ismo

[andres91302]

Hi @isoutamo thank you for taking the time to reply--- yes they are in fact one row with multivalues, is there a way to have this three columns shown or downloaded as a table format where eache value is stored in in cell? for further reference my results come from the following commands: | makemv delim="," ID_SUGGAR | makemv delim="," ID_DOUBLE | eval IDS=mvmap(ID_SUGGAR,if(isnull(mvfind(ID_DOUBLE,ID_SUGGAR)),ID_SUGGAR,null())) thank you much sir

[isoutamo]

Hi 

You could try like this

| makeresults 
| eval A = "1,5,9", B = "2,6,7", C = "3,8,10" 
| makemv delim="," A 
| makemv delim="," B 
| makemv delim="," C
    ```Prepare example data```
| eval foo = mvzip(A,mvzip(B,C))
| fields foo
| mvexpand foo
| makemv delim="," foo
| eval A = mvindex(foo, 0), B = mvindex(foo, 1), C=mvindex(foo,2)
| fields - foo

r. Ismo 

[493669]

@andres91302 
Please try opening downloaded csv file in Microsoft excel to see results in tabular format.


If this reply helps an upvote will be appreciated!