Splunk Search

When does splunk add double quotation in outputcsv?

Communicator

Hi!

I found that when you execute outputcsv in splunk (ver 5.0.3), some fields has double quotation but some does not.
My question is ,

  1. When does splunk add the double quotation?
  2. Can you control the appearance ?

Any help is appreciated!

Thanks,
Yu

Tags (2)
0 Karma

SplunkTrust
SplunkTrust

Hi yuwtennis and sajbutler,

did some tests and here are the results: You will get double quotes when there is any special character (like . or - or a space) in the values.
Here are some simple test you can run and verify the results.

All numeric value:

index=_internal | head 1 | eval foo="19873297326501876528731" | table foo | outputcsv foo.csv

foo.csv looks like this:

cat var/run/splunk/foo.csv
foo
19873297326501876528731

All word characters value:

index=_internal | head 1 | eval foo="noQuotes" | table foo | outputcsv foo.csv

foo.csv looks like this:

cat var/run/splunk/foo.csv
foo
noQuotes

All alphanumeric with special character value:

index=_internal | head 1 | eval foo="Quotes.because.of.the.dot" | table foo | outputcsv foo.csv

foo.csv looks like this:

cat var/run/splunk/foo.csv
foo
"Quotes.because.of.the.dot"

All alphanumeric with special character value:

index=_internal | head 1 | eval foo="Quotes-because-of-the-dash" | table foo | outputcsv foo.csv

foo.csv looks like this:

cat var/run/splunk/foo.csv
foo
"Quotes-because-of-the-dash"

hope this helps ...

cheers, MuS

Path Finder

Hi MuS,

How to remove double quotes from alphanumeric?

SplunkTrust
SplunkTrust

use a trim after the lookup

... | head 1 | eval foo="\"quotes\"" | eval boo=trim(foo, "\"") | table foo boo
0 Karma

Path Finder

@yuwtennis Did you end up getting an answer for this?

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!