I'm doing such a search:
mysearch | stats dc(ip) as countip, values(ip) as valuesip | where countip > xxx | table countip,valuesip
Then either export results via the UI or scheduling and sending the csv results.
The number of returned rows is a few lines (<100)
countip max is about 6000 so the valuesip field may contain a list of 6000 ips
In the Splunk Web UI, it looks correct.
In the csv file, when I look at it in a text editor, I see the line breaks at 991 characters.
Results are not truncated, but they are on the second line and so on.
Obviously, when opening the csv file, it produces garbage ...
So I need to change the "max line length before adding a new line character when exporting by csv" parameter?
I couldn't find which setting it is.
... View more