As we can see below the two events contain multiple results. But when I try to export it as csv all these events get merged into a single row one after the other.
Currently merged output in for one event ---> result1 result2 result3 result4
But I want the data to be exported in csv as it is (i.e all the results in different rows)
Oh, I took shortcut with Splunk's autoformating. Just remove leading space after newline.
| foreach *
[ eval <<FIELD>> = mvjoin(<<FIELD>>, "
") ]
(Autoformating is a great assistant but...)
If line break is the only thing that matters, you can use this crude method
| foreach *
[ eval <<FIELD>> = mvjoin(<<FIELD>>, "
") ]
BTW, your subject line says "imported" as opposed to "exported".
@yuanliuthanks for your help, it worked but now only the first result is correctly aligned, rest of the results can be seen with extra space. Please refer to the image below.
Thanks for correcting the import -> export error
Oh, I took shortcut with Splunk's autoformating. Just remove leading space after newline.
| foreach *
[ eval <<FIELD>> = mvjoin(<<FIELD>>, "
") ]
(Autoformating is a great assistant but...)