How to output CSV file that has one log line per event?

[afellowgood]

I changed my props.conf a while ago so that SHOULD_LINEMERGE=false, and since then, I've gotten my desired result—one log line for one event.

However, whenever I output my search to a CSV file, it still contains the events that were indexed prior to me changing the props.conf. These events still have multiple log lines under a single timestamp.

Is there any way to tell Splunk to retroactively break up those indexed events into their own separate events? Or at least output to a CSV that has one event = one line?

[to4kawa]

you should use fields and table before outputing CSV.

[afellowgood]

I've made sure to do that:

[to4kawa]

and | table _raw _time timestamp
How about this?

[afellowgood]

I tried that and I'm still getting (old) events that contain multiple log lines (separated by \n):

[to4kawa]

It is your _raw .

you should modiy LINE_BREAKER in props.conf

[afellowgood]

Oh, is it getting messed up because \r is in the string "\regular" ?

[to4kawa]

source=...
| eval _raw = replace(_raw,"\\\n","#")
| makemv delim="#" _raw
| stats values(_time) as _time values(timestamp) as timestamp by _raw
| fields _raw _time timestamp
| table _raw _time timestamp

this is workaround.

[to4kawa]

LINE_BREAKER = (\\\n) ?

[afellowgood]

I tried this and I still get the same amount of events, whereas the number of events should increase--does this mean that once events are indexed by Splunk, they can't be separated into smaller events?

This is what my local props.conf looks like:

[to4kawa]

once events are indexed by Splunk, they can't be separated into smaller events?
yes.

maybe it needs |delete and re-indexing.

[afellowgood]

Ah, that's a shame, I don't have the older logs anymore. Thank you so much for your help though, I really appreciate it. I think I'll just try and write a script to manually separate those events. Thanks again!

[to4kawa]

please provide your query to outputcsv

[afellowgood]

I'm not too sure what you mean--are you saying that I can specify this through the outputcsv command?

[to4kawa]

How are you outputting to CSV without using outputcsv?

You're doing a search, aren't you?

[afellowgood]

Oh, I'm using the default export results to create a CSV, I'm not actually using the outputcsv command in the search field.