Splunk Enterprise Security
Highlighted

How to export Incident Review Table to CSV?

Path Finder

How can I export Incident Review table to CSV format? Or, I was wondering if SPL to generate equivalent table is available...

0 Karma
Highlighted

Re: How to export Incident Review Table to CSV?

Path Finder

Umm... I found kvstore "esnotableevents". It must be the data source of Incident Review table.

0 Karma
Highlighted

Re: How to export Incident Review Table to CSV?

Champion

You can do this by querying the table in search and then downloading the results if your lookup has less than 10,000 rows.

Step 1: run search
Run a search for the following:

| inputlookup append=t es_notable_events

Step 2: export results
If the results are less than 10,000, then click the export link (near the print button and the search button) to download the results into a CSV file.

If you have more than 10,000 rows, then the other option would be to add the lookup to the manager lookups list (see "ES Lookups" page under "Configure > Data Enrichment > Lists and Lookups") and then clicking "export".

View solution in original post

Highlighted

Re: How to export Incident Review Table to CSV?

Path Finder

Thank you. It's exactly what I want.

0 Karma
Highlighted

Re: How to export Incident Review Table to CSV?

Contributor

Try running this search:

`notable` | search NOT `suppression` 

You should then be able to just add a "| table" and then the fields you want.

0 Karma
Highlighted

Re: How to export Incident Review Table to CSV?

Path Finder

Thanks. How easy and simple!

0 Karma
Highlighted

Re: How to export Incident Review Table to CSV?

Champion

Could you clarify what you mean by "Incident Review table"? I assumed in my answer that you wanted the table of statuses, comments, etc. but it occurred to me that you may just want the same table that you see on Incident Review in CSV form.

0 Karma