This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

How to make tshark use \t as field separater, rather than default comma, when writing output to csv file?

0

I have described the problem I face when tshark uses , as a field delimiter in this question when writing output to a .csv file.

So I'd like a way to instruct Tshark to use another character, say \t, as field separator.

The normal Tshark command is something like:

tshark -r inputFile.pcap -T fields -e fieldA -e fieldB -e fieldC > outputFile.csv

What do I add to this command to instruct tshark to use \t as field separator, while writing the output to .csv file, rather than the default ,?

asked 11 Oct '16, 00:06

Jesss's gravatar image

Jesss
51141720
accept rate: 0%


One Answer:

1

As per the tshark manual or even built-in help; tshark -h:

  -E<fieldsoption>=<value> set options for output when -Tfields selected:
     bom=y|n               print a UTF-8 BOM
     header=y|n            switch headers on and off
     separator=/t|/s|<char> select tab, space, printable character as separator
     occurrence=f|l|a      print first, last or all occurrences of each field
     aggregator=,|/s|<char> select comma, space, printable character as
                       aggregator

so, use -E separator=/t, you might also want to consider adding quotes around fields, e.g. -E quote=d.

answered 11 Oct '16, 00:43

grahamb's gravatar image

grahamb ♦
19.8k330206
accept rate: 22%

edited 11 Oct '16, 00:44