Export the Search Results

You must have the Export Search Results permission.

Once you have created search queries and criteria, run searches, and viewed results or event details, you can choose to export information to retain or share with colleagues.

Export Search Results

You can export the Search Results table to a .csv file. Search exports the data, based on the specified fieldset for the search. The export process limits the file to one million event records.

  1. In the search toolbar above the histogram, select.

  2. In the resulting Export Options dialog box, select either:

    • Current time range to export the results shown in the current histogram and search results table.

    • Original start time to export the results retrieved from the original start time you selected for the search.

  3. Select either PDF or CSV.

  4. Click Export to export the result to the selected file format.

Additionally, you can export a single result from the results table by right-clicking the row and selecting .pdf as the file format.

 

Saved .csv files of search queries sometimes contain syntax that uses "name= a special character" (such as "name=+" or "name=_"). In Excel, if the file is not opened properly, you might see formatting issues where the fields display as a generic "#NAME".

To avoid this, open the file by selecting From Text/CSV on the Excel Data ribbon. Navigate to the .csv file you downloaded and click Import. Preview the file to ensure the fields display correctly, then click Load to view the full file.

Export Event Details

There may be situations where you need to use event details for reporting purposes. Or you might need to share the event details with an analyst who does not have access to the Event Inspector. You can do so by exporting the event details to .pdf or .csv.

  1. At the top of the Event Inspector, click the Export icon.

  2. Click Export to PDF or Export to CSV.

    The system starts a download of the event details to your selected format.

  3. Share or use the .pdf or .csv as needed.

If you select to show null values, the system includes null values in the exported .csv or .pdf file.

You can also export a single event to a .pdf or .csv file from the Search Results Table. Right-click an event in the Search Results table to open a pop-up menu with the options Export to PDF and Export to CSV. If you use this method to export the event details, null values will be included in the exported file.

Export Scheduled Searches

You have the option to export the completed run of a scheduled search to .csv format.

Export Search Queries and Search Criteria

You can export search queries and search criteria to a gzipped JSON file. (You must have the correct Import and Export permissions to do this.)