# Export from Discovery to CSV

**URL:** https://discuss.elastic.co/t/export-from-discovery-to-csv/353983
**Category:** Elasticsearch
**Created:** [February 23, 2024, 12:43pm UTC](https://discuss.elastic.co/t/export-from-discovery-to-csv/353983 "2024-02-23T12:43:16Z")
**Posts on this page:** 6
**Page:** 1

<div class="post-metadata">

### Author: ![sourcreamnormanbates](https://avatars.discourse-cdn.com/v4/letter/s/f05b48/32.png) [@sourcreamnormanbates](https://discuss.elastic.co/u/sourcreamnormanbates)
#### Post date: [February 23, 2024, 12:43pm UTC](https://discuss.elastic.co/t/export-from-discovery-to-csv/353983/1 "2024-02-23T12:43:17Z")

</div>

I have an ESQL search that outputs a list of unique IP addresses.  
When I Share to CSV, I'm getting "CSV may contain formulas, The report contains characters which spreadsheet applications can interpret as formulas.

When I open the CSV file, instead of a list of IP addresses, each row just has a hyphen instead any actual data.

It appears like this:

count,ip  
"-","-"  
"-","-"  
"-","-"  
"-","-"  
"-","-"  
"-","-"  
"-","-"  
"-","-"  
"-","-"  
"-","-"  
"-","-"  
"-","-"  
"-","-"  
"-","-"  
"-","-"

---

<div class="post-metadata">

### Author: ![jessgarson](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jessgarson/32/129841_2.png) [@jessgarson](https://discuss.elastic.co/u/jessgarson)
#### Post date: [February 23, 2024, 5:14pm UTC](https://discuss.elastic.co/t/export-from-discovery-to-csv/353983/2 "2024-02-23T17:14:43Z")

</div>

Thanks for reaching out @sourcreamnormanbates, I have a few follow up questions here.

- Do you have a code sample by chance you can share?
- What does it look like inside of the console?

---

<div class="post-metadata">

### Author: ![sourcreamnormanbates](https://avatars.discourse-cdn.com/v4/letter/s/f05b48/32.png) [@sourcreamnormanbates](https://discuss.elastic.co/u/sourcreamnormanbates)
#### Post date: [February 26, 2024, 5:54pm UTC](https://discuss.elastic.co/t/export-from-discovery-to-csv/353983/3 "2024-02-26T17:54:35Z")

</div>

Here is the query I'm running:

```auto
from SMTPReceiveLogs*
| where data like "MAIL FROM*"
| rename remote-endpoint as remote
| dissect remote "%{ip}:%{port}"
| stats count = count(ip) by ip
| sort ip

```

Here's what the output looks like.  
 ![IP-Output](https://us1.discourse-cdn.com/elastic/original/3X/4/b/4b96c40e719fcced761984a8543dca7fd71e4f8f.png)

---

<div class="post-metadata">

### Author: ![jessgarson](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jessgarson/32/129841_2.png) [@jessgarson](https://discuss.elastic.co/u/jessgarson)
#### Post date: [February 27, 2024, 9:15pm UTC](https://discuss.elastic.co/t/export-from-discovery-to-csv/353983/4 "2024-02-27T21:15:47Z")

</div>

Thanks for following up with more infomation. Have you tried running the query from the console but specifying the format as CSV? If so, does it also return with blank values?

In the console the query you sent over would look something like this:

```auto
POST _query?format=csv 
{
  "query": """
from SMTPReceiveLogs*
| where data like "MAIL FROM*"
| rename remote-endpoint as remote
| dissect remote "%{ip}:%{port}"
| stats count = count(ip) by ip
| sort ip
  """
}

```

Best,  
Jessica

---

<div class="post-metadata">

### Author: ![sourcreamnormanbates](https://avatars.discourse-cdn.com/v4/letter/s/f05b48/32.png) [@sourcreamnormanbates](https://discuss.elastic.co/u/sourcreamnormanbates)
#### Post date: [February 28, 2024, 12:38pm UTC](https://discuss.elastic.co/t/export-from-discovery-to-csv/353983/5 "2024-02-28T12:38:17Z")

</div>

I had not tried that, but that worked!  
Thanks.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [March 27, 2024, 12:38pm UTC](https://discuss.elastic.co/t/export-from-discovery-to-csv/353983/6 "2024-03-27T12:38:21Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.