Hello,
I have a report in table format that I have created and saved. This has the columns that I find useful with useful names. When I press export and select PDF, I just get the time and the raw data. When I select CSV I get all columns available rather than just those shown in my saved report.
Can someone assist?
Thank you
M
I think you need to select explicitely which column you want to keep, and display them in a table.
Add at the end of your search:
| table Time, User, StartTime, EndTime, Duration, Region, City, Country, rDNS, Gateway
I think you need to select explicitely which column you want to keep, and display them in a table.
Add at the end of your search:
| table Time, User, StartTime, EndTime, Duration, Region, City, Country, rDNS, Gateway
This was exactly the solution - thank you!
What is your report query? Are you using any 'table' or aggregation commands such as stats,chart etc?
Here is my search
index=citrix_ns AND "SSLVPN ICAEND_CONNSTAT" | lookup dnslookup clientip AS CitrixNS_SourceIP OUTPUT clienthost AS rDNS | iplocation CitrixNS_SourceIP AS src_ip | rename CitrixNS_user As User CitrixNS_SourceIP As SourceIP CitrixNS_StartTime As StartTime CitrixNS_EndTime As EndTime CitrixNS_Duration As Duration host As Gateway | eval Time=_time | convert ctime(Time)
It won't let me attach a screenshot of the report but i have the columns sorted
_time
User
StartTime
EndTime
Duration
Region
City
Country
rDNS
Gateway