Splunk Enterprise Security

How to export Incident Review Table to CSV?

diavolo
Path Finder

How can I export Incident Review table to CSV format? Or, I was wondering if SPL to generate equivalent table is available...

0 Karma
1 Solution

LukeMurphey
Champion

You can do this by querying the table in search and then downloading the results if your lookup has less than 10,000 rows.

Step 1: run search
Run a search for the following:

| inputlookup append=t es_notable_events

Step 2: export results
If the results are less than 10,000, then click the export link (near the print button and the search button) to download the results into a CSV file.

If you have more than 10,000 rows, then the other option would be to add the lookup to the manager lookups list (see "ES Lookups" page under "Configure > Data Enrichment > Lists and Lookups") and then clicking "export".

View solution in original post

LukeMurphey
Champion

Could you clarify what you mean by "Incident Review table"? I assumed in my answer that you wanted the table of statuses, comments, etc. but it occurred to me that you may just want the same table that you see on Incident Review in CSV form.

0 Karma

kchamplin_splun
Splunk Employee
Splunk Employee

Try running this search:

`notable` | search NOT `suppression` 

You should then be able to just add a "| table" and then the fields you want.

0 Karma

diavolo
Path Finder

Thanks. How easy and simple!

0 Karma

LukeMurphey
Champion

You can do this by querying the table in search and then downloading the results if your lookup has less than 10,000 rows.

Step 1: run search
Run a search for the following:

| inputlookup append=t es_notable_events

Step 2: export results
If the results are less than 10,000, then click the export link (near the print button and the search button) to download the results into a CSV file.

If you have more than 10,000 rows, then the other option would be to add the lookup to the manager lookups list (see "ES Lookups" page under "Configure > Data Enrichment > Lists and Lookups") and then clicking "export".

diavolo
Path Finder

Thank you. It's exactly what I want.

0 Karma

diavolo
Path Finder

Umm... I found kvstore "es_notable_events". It must be the data source of Incident Review table.

0 Karma
Get Updates on the Splunk Community!

Digital Resilience Assessment Launch | How prepared are you for disruption?

Disruption is inevitable. The question is – how prepared are you to handle it? In today’s fast-moving digital ...

Buttercup Games: Further Dashboarding Techniques (Part 2)

This series of blogs assumes you have already completed the Splunk Enterprise Search Tutorial as it uses the ...

Index This | What is the next number in the series? 7,645 5,764 4,576…

February 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...