000026369 - How to know which CSV format to use for Custom feed .csv files in RSA Security Analytics

Document created by RSA Customer Support Employee on Jun 14, 2016Last modified by RSA Customer Support Employee on Apr 21, 2017
Version 2Show Document
  • View in full screen mode

Article Content

Article Number000026369
Applies ToRSA Security Analytics
RSA NetWitness Live Manager
RSA NetWitness Live Manager 2.x
IssueHow to know which CSV format to use for Custom feed .csv files in RSA Security Analytics.
The Documentation mentions the Custom feed data file must be in a .csv file, but which format of CSV should I use?

Microsoft Excel can save a .csv file in various formats:

CSV (Comma Delimited) (*.csv)
CSV (Macintosh) (*.csv)
CSV (MS-DOS) (*.csv)

The difference between the various formats is in the use of certain special characters.
The Macintosh option converts the windows CR/LF at the end of each line to the Macintosh CR only standard.
Windows CSV (Comma Delimited), saves the characters encoded using the Windows-1252 code page. This allows certain special characters in text fields; for example, an accented (foreign language) character.
DOS encoding uses code page 437, which maps characters used in old pre-Windows PCs.


For standard English characters in Windows use the CSV (MS-DOS) format, as this one will encounter the least issue.


A file created on a unix system (like using the vi editor) has by default a end of each line with the LF only, and not the windows CR/LF.

If the CSV file was created in SA unix appliance, and needs to be saved in DOS format then use the following vi commands on the SA appliance to convert:

vi +':w ++ff=dos' +':q!' {filename}

 {filename}, is the name of the file to be converted to dos format.  Substitute this value for the correct filename.
 ff=dos, sets the vi file format to dos.
 :wq!, writes the file and quits back to the command prompt.

Legacy Article IDa64482