- Find Answers
- :
- Premium Solutions
- :
- Splunk Enterprise Security
- :
- How to export Incident Review Table to CSV?
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
How can I export Incident Review table to CSV format? Or, I was wondering if SPL to generate equivalent table is available...
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You can do this by querying the table in search and then downloading the results if your lookup has less than 10,000 rows.
Step 1: run search
Run a search for the following:
| inputlookup append=t es_notable_events
Step 2: export results
If the results are less than 10,000, then click the export link (near the print button and the search button) to download the results into a CSV file.
If you have more than 10,000 rows, then the other option would be to add the lookup to the manager lookups list (see "ES Lookups" page under "Configure > Data Enrichment > Lists and Lookups") and then clicking "export".
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Could you clarify what you mean by "Incident Review table"? I assumed in my answer that you wanted the table of statuses, comments, etc. but it occurred to me that you may just want the same table that you see on Incident Review in CSV form.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Try running this search:
`notable` | search NOT `suppression`
You should then be able to just add a "| table" and then the fields you want.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thanks. How easy and simple!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You can do this by querying the table in search and then downloading the results if your lookup has less than 10,000 rows.
Step 1: run search
Run a search for the following:
| inputlookup append=t es_notable_events
Step 2: export results
If the results are less than 10,000, then click the export link (near the print button and the search button) to download the results into a CSV file.
If you have more than 10,000 rows, then the other option would be to add the lookup to the manager lookups list (see "ES Lookups" page under "Configure > Data Enrichment > Lists and Lookups") and then clicking "export".
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thank you. It's exactly what I want.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Umm... I found kvstore "es_notable_events". It must be the data source of Incident Review table.
Enterprise Security Content Update (ESCU) | New Releases
Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?
Index This | What are the 12 Days of Splunk-mas?
