Splunk Enterprise Security

How to export Incident Review Table to CSV?

Path Finder

How can I export Incident Review table to CSV format? Or, I was wondering if SPL to generate equivalent table is available...

0 Karma
1 Solution

Champion

You can do this by querying the table in search and then downloading the results if your lookup has less than 10,000 rows.

Step 1: run search
Run a search for the following:

| inputlookup append=t es_notable_events

Step 2: export results
If the results are less than 10,000, then click the export link (near the print button and the search button) to download the results into a CSV file.

If you have more than 10,000 rows, then the other option would be to add the lookup to the manager lookups list (see "ES Lookups" page under "Configure > Data Enrichment > Lists and Lookups") and then clicking "export".

View solution in original post

Champion

Could you clarify what you mean by "Incident Review table"? I assumed in my answer that you wanted the table of statuses, comments, etc. but it occurred to me that you may just want the same table that you see on Incident Review in CSV form.

0 Karma

Splunk Employee
Splunk Employee

Try running this search:

`notable` | search NOT `suppression` 

You should then be able to just add a "| table" and then the fields you want.

0 Karma

Path Finder

Thanks. How easy and simple!

0 Karma

Champion

You can do this by querying the table in search and then downloading the results if your lookup has less than 10,000 rows.

Step 1: run search
Run a search for the following:

| inputlookup append=t es_notable_events

Step 2: export results
If the results are less than 10,000, then click the export link (near the print button and the search button) to download the results into a CSV file.

If you have more than 10,000 rows, then the other option would be to add the lookup to the manager lookups list (see "ES Lookups" page under "Configure > Data Enrichment > Lists and Lookups") and then clicking "export".

View solution in original post

Path Finder

Thank you. It's exactly what I want.

0 Karma

Path Finder

Umm... I found kvstore "es_notable_events". It must be the data source of Incident Review table.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!