Getting Data In

What is the default delimiter for multivalue fields in Splunk when exporting a table to a CSV file?

gfs2277
New Member

Hi guys,

i just want to know the default delimiter for multivalue field in splunk
when i export a table to a csv.file
if the multivalue field is splunk generated , i can see the values are line by line in its csv cell
but if it generated manually , such as the following :

| eval cfxA=cfsnA."///".cfmnA."///".cfszA
| makemv delim="///" cfxA

i can only see the values are all in the same line and delimited by "///"
who can tell me which delimiter could let them displayed line by line , please ?

0 Karma

jrodman
Splunk Employee
Splunk Employee

The delimiters used by makemv etc are instructions on how to take a string and identify multiple values within it. In-memory, there simply multiple string values for the field, without any delimeters.

When we serialize the multivalue fields to csv, typically there are two reprsentations, one representation acts as a hint that there is a multivalue field, and the other representation is newline-delimited. This is true for data passed to a python search command, or when using the |outputcsv command. I'm not familiar with what you get when using the in-gui "export" feature with multivalue fields.

In the current implementation, the system actually tracks a single-value string and a multi-value set of values for a field that is multivalue, so we may provide the single-value string when exporting even though we will ignore it. (If relevant, this is an implementation wart which will eventually go away.)

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...