outputcsv
This documentation applies to the following versions of Splunk: 4.0 , 4.0.1 , 4.0.2 , 4.0.3 , 4.0.4 , 4.0.5 , 4.0.6 , 4.0.7 , 4.0.8 , 4.0.9 , 4.0.10
outputcsv
Synopsis
Outputs search results to the specified csv file.
Syntax
outputcsv [usexml=bool] [singlefile=bool] [filename]
Arguments
- usexml
- Datatype: <bool>
- Description: Specifies whether or not to encode the csv output into xml and has effect only when no filename is specified.
- singlefile
- Datatype: <bool>
- Description: If singlefile is set to true and output spans multiple files, collapses it into a single file
Description
If no filename specified, rewrites the contents of each result as a csv row into the _xml field. Otherwise writes into file (appends .csv to filename if filename has no existing extension). If singlefile is set to true and output spans multiple files, collapses it into a single file. the option usexml=[t|f] specifies whether or not to encode the csv output into xml and has effect only when no filename is specified. This option should not specified when invoking outputcsv from the ui.
Examples
Example 1: Output search results to the CSV file 'mysearch.csv'.
... | outputcsv mysearch