Wireshark-dev: Re: [Wireshark-dev] Output of 'tshark -T fields' with multiple occurrences of a
On 19 jul 2010, at 17:03, Martin Visser wrote:
> Not saying that this isn't a good idea (being able to output repeated fields), but I suspect when it gets to stable you might get some complaints. If people use "-T fields" like they do a CSV file, they might be expecting a fixed number of columns. (Currently whether there are 0, 1 or more instances, I think there are always the same number of commas).
Well, the fields are still separated with tabs (by default), but within a field, multiple occurrences are now separated by commas (by default). I added another option to be able to select the value of the first occurrence of the field, the last occurrence (as it was before my change) and all occurrences (the new default):
-T pdml|ps|psml|text|fields
format of text output (def: text)
-e <field> field to print if -Tfields selected (e.g. tcp.port);
this option can be repeated to print multiple fields
-E<fieldsoption>=<value> set options for output when -Tfields selected:
header=y|n switch headers on and off
separator=/t|/s|<char> select tab, space, printable character as separator
occurrence=f|l|a print first, last or all occurrences of each field
aggregator=,|/s|<char> select comma, space, printable character as aggregator
quote=d|s|n select double, single, no quotes for values
I think that will give everyone the granularity of control they might need.
> You might want to think about adding this new feature only by adding a new switch (say the -E aggregator switch)
Would showing the value of the last occurrence of the field (-E occurrence=l) be a better default? That way the behavior does not change unless you specifically ask for it.
Cheers,
Sake
