Splunk Search

When does splunk add double quotation in outputcsv?

yuwtennis
Communicator

Hi!

I found that when you execute outputcsv in splunk (ver 5.0.3), some fields has double quotation but some does not.
My question is ,

  1. When does splunk add the double quotation?
  2. Can you control the appearance ?

Any help is appreciated!

Thanks,
Yu

Tags (2)
0 Karma

MuS
SplunkTrust
SplunkTrust

Hi yuwtennis and sajbutler,

did some tests and here are the results: You will get double quotes when there is any special character (like . or - or a space) in the values.
Here are some simple test you can run and verify the results.

All numeric value:

index=_internal | head 1 | eval foo="19873297326501876528731" | table foo | outputcsv foo.csv

foo.csv looks like this:

cat var/run/splunk/foo.csv
foo
19873297326501876528731

All word characters value:

index=_internal | head 1 | eval foo="noQuotes" | table foo | outputcsv foo.csv

foo.csv looks like this:

cat var/run/splunk/foo.csv
foo
noQuotes

All alphanumeric with special character value:

index=_internal | head 1 | eval foo="Quotes.because.of.the.dot" | table foo | outputcsv foo.csv

foo.csv looks like this:

cat var/run/splunk/foo.csv
foo
"Quotes.because.of.the.dot"

All alphanumeric with special character value:

index=_internal | head 1 | eval foo="Quotes-because-of-the-dash" | table foo | outputcsv foo.csv

foo.csv looks like this:

cat var/run/splunk/foo.csv
foo
"Quotes-because-of-the-dash"

hope this helps ...

cheers, MuS

mvaradarajam
Path Finder

Hi MuS,

How to remove double quotes from alphanumeric?

MuS
SplunkTrust
SplunkTrust

use a trim after the lookup

... | head 1 | eval foo="\"quotes\"" | eval boo=trim(foo, "\"") | table foo boo
0 Karma

sajbutler
Path Finder

@yuwtennis Did you end up getting an answer for this?

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!