Running a Query Viewer Report

Purpose:

To generate a simple report based on query viewer results, therefore providing a convenient way to share the result data.

Query viewer reports are limited to displaying data from the single query covered by the query viewer and retain the format of the chart or table in which the query viewer results are displayed.

To generate a report on a query viewer:

1. Right-click the query viewer results table or chart (anywhere in the Viewer panel) and select Report.

2. Specify the options on the Report Parameters dialog or take the deaults and click OK.

    

   Report Parameter Values

   Common Parameters	Description
   Report Format	From the drop-down menu, select one of the following report output formats: pdf - Outputs the report as an Adobe PDF file. xls - Generates a Microsoft Excel file for tables and charts. Note: XLS reports you run with Microsoft Excel 2002 might have page break format problems (misalignments, column spillover) due to default page size settings in Excel. To correct this problem, open the resulting XLS report in Excel, choose File > Page Setup from the menus, change the paper size to Letter (instead of Legal), and click OK to save your changes. The report has the appropriate page break formatting. This problem does not occur in newer versions of Microsoft Excel. Note: XLS report formats display speedometer charts as pie charts. This is a known limitation in Microsoft Excel. rtf - Produces a rich-text format document. csv - Creates tabular data as a list of comma-separated values. Note: Reports generated in CSV format are not the full equivalent of exports to other formats like PDF or HTML. CSV format is useful for loading report data into a spreadsheet for further manipulation. Since CSV is meant to contain tabular data, only the table data of a report is normally useful. Therefore, ArcSight exports only the table data portion of a report to CSV format, ignoring any other report information such as charts or text, including report titles. html - Generates the report in a Web page displayed by the default web browser. Note: Running a report with a huge row limit (10,000 rows) in HTML format may cause the browser to be unresponsive. In such cases, run the report in PDF. Your selection affects your choice for e-mail formats. See description for Email Format, another report parameter, in this table. The output file is created at report runtime and is stored in the Archived Report Group corresponding to the report’s group. See the Archives tab on the report’s edit panel.
   Page Size	From the drop-down menu, select a paper size.
   Run as User	This option is not available for case reports. Run the report as a particular user. From the drop-down menu, select the user name by which you would like to run the report. For example, this option would allow an administrator for a Managed Security Service Provider (MSSP) to run report for a customer. The administrator would need write permissions to the user.
   Email to	You can have the report sent as e-mail to one or more ArcSight users. From the drop-down menu, select the Console users to whom the report should be e-mailed. The selection list is read from the Users resource). The recipient will only see his or her user name in the To field even if there are multiple recipients for this report. Handling empty reports: If you are emailing reports, empty reports will also be sent. This is determined by the server property, report.scheduler.notify_empty_reports, which is set to true. If you do not want empty reports to be sent, add the property to the server.properties file and change the setting to false. Follow the instructions in the ESM Administrator’s Guide on how to edit this file. The details are in the guide’s topic, "Managing and Changing Properties File Settings."
   Email addresses	Send the report to one or more comma-separated or semicolon-separated e-mail addresses. This option does not require the recipient to be an ArcSight user. Note: The recipient will only see his or her e-mail address in the To field even if there are multiple recipients for this report.
   Email Format	Specify how the report is to be accessed by the recipient. Select Send URL if you want to point users to the report. Use this option if the report is large and is saved (archived) to a network-accessible location You can provide URLs for all report formats: PDF, XLS, RTF, CSV, and HTML. Select Attach Report if you want to send the report directly to the user's e-mail box. You can only attach PDF, XLS, RTF, and CSV report formats. Select Attach Compressed Report if you want the PDF, XLS, RTF, or CSV report to be compressed (zipped) first before mailing. If you want to display the report on the e-mail message body so that the recipient immediately sees the report upon opening the e-mail, select Embed Report. You can only embed CSV and HTML report formats. Note: The notification automatically uses the URL if you select an email format for an unsupported report format, or if the attachment is too large to be sent. You can adjust the maximum attachment size up to 100 MB with the property, report.upload.maxFileSize. Set this property to the size you want in the server.properties file. Refer to the ESM Administrator's Guide for procedures to edit properties files.
   Email Subject	Specify the subject on the notification. Defaults to the report’s Name attribute (denoted by $ReportName). If you want to use a customized subject, type the text either in addition to the default or replace the default text entirely.

    

Tip: If you click Save Output on the Report Parameters dialog, you get additional options for setting the archived report under the Save Output Parameters section.

When the report is ready, a dialog gives you the option of opening it to view it now or saving it to a location you specify through a file browser.

3. Select Open to view the report or Save to save it in a specified location.