-
Notifications
You must be signed in to change notification settings - Fork 200
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Double quote CSV fields #965
Comments
@YamatoSecurity
I am assuming that with this modification, it would look something like this.
|
hitenkoku
added a commit
that referenced
this issue
Mar 17, 2023
hitenkoku
added a commit
that referenced
this issue
Mar 17, 2023
hitenkoku
added a commit
that referenced
this issue
Mar 17, 2023
hitenkoku
added a commit
that referenced
this issue
Mar 17, 2023
hitenkoku
added a commit
that referenced
this issue
Mar 18, 2023
hitenkoku
added a commit
that referenced
this issue
Mar 18, 2023
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
@hitenkoku
Is it possible to enclose fields in CSV output in double quotes?
For example, instead of:
2020-05-02 02:55:26.493 +00:00,UZUMAKI-PC.hinokabe.local,Sysmon,10,low,138294,Proc Access,SrcProc: C:\windows\system32\svchost.exe ¦ TgtProc: C:\windows\System32\svchost.exe ¦ SrcUser: n/a ¦ TgtUser: n/a ¦ Access: 0x1000 ¦ SrcPID: 900 ¦ SrcPGUID: {6bbf237a-cafb-5eac-1000-000000000400} ¦ TgtPID: 2092 ¦ TgtPGUID: {6bbf237a-cb97-5eac-6202-000000000400}
I want to output:
"2020-05-02 02:55:26.493 +00:00","UZUMAKI-PC.hinokabe.local","Sysmon","10","low","138294","Proc Access","SrcProc: C:\windows\system32\svchost.exe ¦ TgtProc: C:\windows\System32\svchost.exe ¦ SrcUser: n/a ¦ TgtUser: n/a ¦ Access: 0x1000 ¦ SrcPID: 900 ¦ SrcPGUID: {6bbf237a-cafb-5eac-1000-000000000400} ¦ TgtPID: 2092 ¦ TgtPGUID: {6bbf237a-cb97-5eac-6202-000000000400}"
The reason is the
Details
and especiallyAllFieldInfo
field are too long so I want to convert¦
to return character but because the strings do not have double quotes, the new characters put the fields on the next row.Something like this:
cat results.csv | awk '{gsub(/ ¦ /,"\r\n"); print;}' > multi-line-results.csv
If
results.csv
uses double quotes, we can import with multiple lines like this:This makes things easier to analyze on normal screens.
The text was updated successfully, but these errors were encountered: