Splunk Enterprise Security

How to export Incident Review Table to CSV?

diavolo
Path Finder

How can I export Incident Review table to CSV format? Or, I was wondering if SPL to generate equivalent table is available...

0 Karma
1 Solution

LukeMurphey
Champion

You can do this by querying the table in search and then downloading the results if your lookup has less than 10,000 rows.

Step 1: run search
Run a search for the following:

| inputlookup append=t es_notable_events

Step 2: export results
If the results are less than 10,000, then click the export link (near the print button and the search button) to download the results into a CSV file.

If you have more than 10,000 rows, then the other option would be to add the lookup to the manager lookups list (see "ES Lookups" page under "Configure > Data Enrichment > Lists and Lookups") and then clicking "export".

View solution in original post

LukeMurphey
Champion

Could you clarify what you mean by "Incident Review table"? I assumed in my answer that you wanted the table of statuses, comments, etc. but it occurred to me that you may just want the same table that you see on Incident Review in CSV form.

0 Karma

kchamplin_splun
Splunk Employee
Splunk Employee

Try running this search:

`notable` | search NOT `suppression` 

You should then be able to just add a "| table" and then the fields you want.

0 Karma

diavolo
Path Finder

Thanks. How easy and simple!

0 Karma

LukeMurphey
Champion

You can do this by querying the table in search and then downloading the results if your lookup has less than 10,000 rows.

Step 1: run search
Run a search for the following:

| inputlookup append=t es_notable_events

Step 2: export results
If the results are less than 10,000, then click the export link (near the print button and the search button) to download the results into a CSV file.

If you have more than 10,000 rows, then the other option would be to add the lookup to the manager lookups list (see "ES Lookups" page under "Configure > Data Enrichment > Lists and Lookups") and then clicking "export".

diavolo
Path Finder

Thank you. It's exactly what I want.

0 Karma

diavolo
Path Finder

Umm... I found kvstore "es_notable_events". It must be the data source of Incident Review table.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...