How to export Incident Review Table to CSV?

[diavolo]

How can I export Incident Review table to CSV format? Or, I was wondering if SPL to generate equivalent table is available...

[LukeMurphey]

Could you clarify what you mean by "Incident Review table"? I assumed in my answer that you wanted the table of statuses, comments, etc. but it occurred to me that you may just want the same table that you see on Incident Review in CSV form.

[kchamplin_splun]

Try running this search:

`notable` | search NOT `suppression` 

You should then be able to just add a "| table" and then the fields you want.

[diavolo]

Thanks. How easy and simple!

[LukeMurphey · Accepted solution]

You can do this by querying the table in search and then downloading the results if your lookup has less than 10,000 rows.

Step 1: run search
Run a search for the following:

| inputlookup append=t es_notable_events

Step 2: export results
If the results are less than 10,000, then click the export link (near the print button and the search button) to download the results into a CSV file.

If you have more than 10,000 rows, then the other option would be to add the lookup to the manager lookups list (see "ES Lookups" page under "Configure > Data Enrichment > Lists and Lookups") and then clicking "export".

[diavolo]

Thank you. It's exactly what I want.

[diavolo]

Umm... I found kvstore "es_notable_events". It must be the data source of Incident Review table.