Anonymous_User Absent Member.
Absent Member.
200 views

How to open exported csv events file in Excel?


Hi all,

This is a really dummy question, but I'm unable to open an exported csv
events file in Excel. I tried to use comma separated and used the text
qualifier as double quotes, but the result remains rough and tumble.

I just exported all fields from all last 1 hour events.

Can anybody help me?

Thanks,
Alexandre


--
agorian
------------------------------------------------------------------------
agorian's Profile: https://forums.netiq.com/member.php?userid=1099
View this thread: https://forums.netiq.com/showthread.php?t=50110

0 Likes
3 Replies
Anonymous_User Absent Member.
Absent Member.

Re: How to open exported csv events file in Excel?

Could you post a few lines from from the file, perhaps using 'head' or
something to grab the top few lines? What were the steps you used,
exactly (perhaps with a link to documentation followed), to generate the
export from Sentinel?

--
Good luck.

If you find this post helpful and are logged into the web interface,
show your appreciation and click on the star below...
0 Likes
Anonymous_User Absent Member.
Absent Member.

Re: How to open exported csv events file in Excel?


Hi Ab,

I followed this link:

http://tinyurl.com/kr2esb6

I’d searched for all events (sev:[0 to 5]) for last 1 hour, selected all
events and exported all fields. Just double click in file and excel made
mistakes as showing.

So, I exported just two events and tried a different approach. This is
the file:


Code:
--------------------

ObserverTZMinute(estzmin),SearchTargetID(rv172),RetentionPolicyID(rv171),SentinelProcessTime(spt),TaxonomyLevel2(rv51),TaxonomyLevel3(rv52),XDASProvider(xdasprov),ReservedVar143(rv143),ObserverType(st),Vulnerability(vul),ObserverTZDayInYear(estzdiy),ObserverTZDayInWeek(estzdiw),InitiatorServiceName(sp),TenantHierarchyID(rv1),SourceHostID(rv77),ObserverTZDayInMonth(estzdim),TaxonomyLevel1(rv50),CollectorPluginName(agent),Message(msg),XDASOutcome(xdasoutcome),TargetUserName(dun),ReporterIP(repip),VendorEventCode(rv40),ObserverIP(obsip),TargetUserDomain(rv45),ProductName(pn),ReporterHostID(repassetid),CollectorNodeName(port),EventTime(dt),Severity(sev),ObserverEventTime(det),XDASDetail(xdasdetail),XDASClass(xdasclass),RetentionPolicyName(rv192),ObserverTZMonth(estzmonth),InitiatorUserName(sun),ReservedVar033(rv33),InitiatorServiceComponent(isvcc),ObserverTZ(estz),InitiatorUserDomain(rv35),CollectorPluginID(rv122),IDSName(rv31),SentinelID(rv121),ObserverCategory(rv32),MinRetentionDate(rv164),SentinelServiceID(src),XDASTaxonomyName(xdastaxname),TenantName(rv39),XDASRegistry(xdasreg),TargetHostID(rv99),XDASIdentifier(xdasid),TransactionID(evtgrpid),InitiatorUserID(iuid),EventSourceID(rv24),RawDataRecordId(rv25),CollectorID(rv22),ConnectorID(rv23),SourceIP(sip),CollectorManagerID(rv21),XDASOutcomeName(xdasoutcomename),ExtendedInformation(ei),EventName(evt),ObserverHostID(obsassetid),ObserverEventTimeString(et),ObserverTZHour(estzhour)
21,D860D7C0-CFBF-1030-B1C4-000C29857F7C,408E7E50-C02E-4325-B7C5-2B9FE4853476,1393356094718,WORKFLOW,NOTIFY,0,Activity,N,0,56,3,metaEmpresaTerceiraCadastrar,0,0,25,SYSTEM,Novell Identity Manager,"Initiated by cn=npiquet,ou=users,o=data; Process ID: 0a8d42633b9b47ef9dba3ef0c0a77ea8; Process Name: cn=metaEmpresaTerceiraCadastrar,cn=RequestDefs,cn=AppConfig,cn=User Application Driver,cn=driverset1,o=system:219; Activity: Activity; Recipient: cn=npiquet,ou=users,o=data; Author: cn=npiquet,ou=users,o=data; Message: {""gid"":""UserApp#UserStartWorkflow#d64f1045-d460-4d43-8802-7a0c7ee7dd18"",""Data"":""Solicitado o cadastro da empresa testes com erro com e-mail: email1@empresa.com.br pelo motivo: asdfasdf asdf""}",0,npiquet,172.17.2.131,0003152C,172.17.2.131,\data\users,Novell Identity Manager,0,Novell Identity Manager,1393356094718,0,1393356251002,0,10,default,1,npiquet,UserApp#UserStartWorkflow#d64f1045-d460-4d43-8802-7a0c7ee7dd18,Activity,America/Sao_Paulo,\data\users,6697F190-8F23-102C-9FAB-005056C00008,Identity Manager,D860D7C0-CFBF-1030-B160-000C29857F7C,IDM,1401148800000,D892E9F0-3CA7-102B-B59E-005056C00005,XDAS_AE_WF_FINISH,unknown,0,0,3,0a8d42633b9b47ef9dba3ef0c0a77ea8,"cn=npiquet,ou=users,o=data",9084B0A0-8056-1031-9108-000C299BE9F8,9084B0A0-8056-1031-BF32-000C299BE9F8,D892E9F0-3CA7-102B-B59E-005056C00005,D892E9F0-3CA7-102B-B59F-005056C00005,172.17.2.131,C76D2820-C395-1029-BB86-001321B5C0B3,XDAS_OUT_SUCCESS,"Workflow revision=219; Activity=Activity; Author=cn=npiquet,ou=users,o=data; MIMEtype=text/plain;",User Message : Activity,0,Tue Feb 25 2014 16:24:11 GMT-0300 (BRT),16
20,D860D7C0-CFBF-1030-B1C4-000C29857F7C,408E7E50-C02E-4325-B7C5-2B9FE4853476,1393356056262,WORKFLOW,NOTIFY,0,Activity,N,0,56,3,metaEmpresaTerceiraCadastrar,0,0,25,SYSTEM,Novell Identity Manager,"Initiated by cn=npiquet,ou=users,o=data; Process ID: d10270e74fc6495da3034afefb2c32fa; Process Name: cn=metaEmpresaTerceiraCadastrar,cn=RequestDefs,cn=AppConfig,cn=User Application Driver,cn=driverset1,o=system:219; Activity: Activity; Recipient: cn=npiquet,ou=users,o=data; Author: cn=npiquet,ou=users,o=data; Message: {""gid"":""UserApp#UserStartWorkflow#eb6fb55b-a3ea-44cb-9b7b-b666d9f48f20"",""Data"":""Solicitado o cadastro da empresa mais uma de testes com e-mail: email@empresa.com.br pelo motivo: asdfasd asdf""}",0,npiquet,172.17.2.131,0003152C,172.17.2.131,\data\users,Novell Identity Manager,0,Novell Identity Manager,1393356056262,0,1393356213001,0,10,default,1,npiquet,UserApp#UserStartWorkflow#eb6fb55b-a3ea-44cb-9b7b-b666d9f48f20,Activity,America/Sao_Paulo,\data\users,6697F190-8F23-102C-9FAB-005056C00008,Identity Manager,D860D7C0-CFBF-1030-B160-000C29857F7C,IDM,1401148800000,D892E9F0-3CA7-102B-B59E-005056C00005,XDAS_AE_WF_FINISH,unknown,0,0,3,d10270e74fc6495da3034afefb2c32fa,"cn=npiquet,ou=users,o=data",9084B0A0-8056-1031-9108-000C299BE9F8,9084B0A0-8056-1031-BE25-000C299BE9F8,D892E9F0-3CA7-102B-B59E-005056C00005,D892E9F0-3CA7-102B-B59F-005056C00005,172.17.2.131,C76D2820-C395-1029-BB86-001321B5C0B3,XDAS_OUT_SUCCESS,"Workflow revision=219; Activity=Activity; Author=cn=npiquet,ou=users,o=data; MIMEtype=text/plain;",User Message : Activity,0,Tue Feb 25 2014 16:23:33 GMT-0300 (BRT),16

--------------------


--
agorian
------------------------------------------------------------------------
agorian's Profile: https://forums.netiq.com/member.php?userid=1099
View this thread: https://forums.netiq.com/showthread.php?t=50110

0 Likes
Anonymous_User Absent Member.
Absent Member.

Re: How to open exported csv events file in Excel?


I renamed the file as .txt and opened in excel selecting comma as field
delimiter and double quotes as text qualifier. It opened ok, all fields
in the correct position.

So, I gone back to the first export and tried using the same method
(file attached)


Note that columns show different information:


'[image: http://imagizer.imageshack.us/v2/800x600q90/541/y1ue.png]'
(https://imageshack.com/i/f1y1uep)153153


+----------------------------------------------------------------------+
|Filename: Eventos_250214_1393356311477.zip |
|Download: https://forums.netiq.com/attachment.php?attachmentid=153 |
+----------------------------------------------------------------------+

--
agorian
------------------------------------------------------------------------
agorian's Profile: https://forums.netiq.com/member.php?userid=1099
View this thread: https://forums.netiq.com/showthread.php?t=50110

0 Likes
The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.