Exporting Events to a File

You can export a set of data fields into a comma separated values (CSV) file.

The procedures in this topic instruct you to:

• Export data fields into a CSV file

• Limit exported fields to only those fields that are visible on the channel

To export to a CSV file:

1. In the channel, select one or more events.

2. Right-click and select Export > Events in Channel.

3. On the Export Events file browser, navigate to the location where you want to save the CSV file, then enter or select options for these fields:

   File Name	Enter a file name for the CSV file. Note: The file name extension is not required; the csv extension is added automatically when the file is created.
   Files of Type	Select Comma separated values (*.csv).
   Export Data Options	For Rows, you have two options: If you select All in channel, all events in the channel will be exported to the CSV file. If you select Selected rows only, only those rows highlighted for the right-click operation will be exported to the CSV file. The default for Columns is the Export field set. Keep the default or select other field sets from a list of All Field Sets. For Destination, select Local CSV File.

4. Click OK.

To limit the export to fields visible in the channel:

Purpose: The default “Export” field includes a large number of columns. Unless you have a pressing need to export all these fields for channel events, you might want to modify the export. Exporting a large field set for a large event set could be time- and resource-consuming.

• If the channel is unmodified from its default (you have not added or removed fields), you can select the channel’s default field set on the file export option. To find the default field set name, edit the channel and look at “Default Field Set” name or right-click any column header in the channel and choose Field Set > Selected Field Set. The default field set will be selected. (For example, for /All Active Channels/ArcSight System/Core/Live active channel, the default field set is Standard-MgrRcpt. Selecting this field set on the export will give you that set of columns in the CSV file.)

• If you have modified the channel from its default (added or removed fields), you can save it as a custom field set and then choose your custom field set on the export dialog. To save a custom field set, right-click anywhere on the column headers in the active channel and choose Field Sets > Save As. On the Field Sets Selector, navigate to the group you want, name the new field set and click OK. Now it will be available to choose from on the export dialog.

The Export field set itself is also customizable. If you are sure you always want exported events to include a limited set of fields, you can edit the Export field set. See Creating a Field Set and Editing a Field Set.