IBM Support

QRadar: Displaying proper columns in a CSV Export

Question & Answer


Question

When you export all columns on the Log Activity or Network Activity tabs to a CSV or XML file, the resulting file does not include the source or destination MAC address for the events or flows, so how do you get the needed columns?

Cause

Export only include certain columns.

Answer

When you perform an export of Visual Columns, only the columns included in the search results are exported.
There is also an option to do a Full Export which includes all columns common to the resulting search. For custom properties you would need to add each custom property as a column to display in the search.

image-20190216133726-1



Where do you find more information?



[{"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Component":"Admin Console","Platform":[{"code":"PF016","label":"Linux"}],"Version":"7.1;7.2","Edition":"All Editions","Line of Business":{"code":"LOB24","label":"Security Software"}}]

Document Information

Modified date:
16 February 2019

UID

swg21622729