I am trying to put some tshark output into a csv file, which is not that hard with " [...]>> file.csv"
But the problem is which separator to choose with "-E separator=[??}". Default is "," but this is also in the output data, so that causes problems, same with ";".
So which is the best, safest, unique separator to choose when converting into csv?
The -E separator sets the separator and the default is a tab.
The -E aggregator is used when grouping a field. The default value is a comma, which can be altered too.
Personally I would use -E "separator=;" (note: quoted to avoid shell interpretation) and leave the aggregator as is. Most applications (e.g. Excel) will import this just as easy and avoids decimal point issues in different languages.
You can also use -E quote=d to force quoting all fields, in case some contains a separator or an aggregator character.
Doesn't Wireshark deliver quoted strings in CSV output?
tshark -T fields -e ip.addr without -E quote=d will output unquoted IP addresses (aggregated by comma). At least on Windows and Linux, I cannot check MacOS.
Thank you for your answer, but unfortunately the -E "separator=;" doesn't work for me. There are already a lot of ";" in the data and these also get interpreted as separators. So I am looking for something unique of something smart.
What also doesn't help, is that I want to view the data in Excel, which gives it's own stupid interpretation of the data and quotes when used.
In case of Excel, there are several options to import a custom CSV file, thus set the delimiter and quotes usage. For example:
You can use any character you want as a delimiter in both Excel as -E quote option. The default tab character works fine too.
Comments