Exporting data from Endpoint Troubleshooting

Results visible in Endpoint Troubleshooting can be exported to files containing comma-separated values (CSV) or, in the case of the Export all option on the instruction response page, tab-separated values (TSV), and results can be marked for export at the point of asking a question to automate the process.

Exporting the responses instruction list

To export the responses instruction list, an administrator would follow these steps:

The instruction list displayed on the Responses page can be exported to a .csv file.

Clicking on the Export button exports the current page of instructions to a file called instructionsList.csv.

You can check the contents of the file in a text application such as Notepad.

Exporting instruction responses

Exporting the values enables the responses to be acted upon outside of 1E via a script, batch file or 3rd party application.

The information contained in the responses to a particular instruction can be exported in various ways:

On a single page basis to a .csv file from the Endpoint Troubleshooting. Single-page exports are output in comma-separated format. This is to enable the limited amount of data to be easily viewed in a spreadsheet application. Because of the small amount of data held in these files single-page exports are downloaded via the website to the browser's download cache.

Exporting the drill-down information held for a single item in the responses page.

Exporting all the responses to a .tsv file once the instruction has completed. Exporting all the responses outputs to a tab-separated format file. This is to enable the potentially large amount of data to be easily processed by a 3rd party application. Because of the potentially large amount of data these files are output to a share location that must be selected by the user.

To demonstrate these types of export we'll use the responses for the question Which Windows services are disabled?

Exporting one page of the top-level responses

To export one page of the top-level responses, follow these steps:

To export the current page of responses click on the Export button in the row just above the table heading where the responses are displayed. The Export button is shown highlighted in the picture opposite, and the resulting file, called aggregatedResults.csv, is downloaded to the browser's download folder, as seen in the bottom-left of the chrome browser shown in the picture.

For top-level responses the output file is always called aggregatedResults.csv. If the file already exists in the downloads folder the browser will usually rename the downloaded file by appending consecutive numbers to the end.

When you open the .csv file you will see the exported responses from the current page. The picture shows the aggregatedResults.csv file opened using notepad.

An administrator could then use these responses to identify any disabled services that should be running.

Exporting drill-down responses

Let's suppose that an administrator is interested in investigating and taking action on the devices where the Internet Connection Sharing (ICS) service is disabled.

To export drill-down responses, follow these steps:

Clicking on that top-level response for that service displays all the devices that have responded to say that it is disabled. In our example this shows a number of devices where the service has been disable, as shown in the picture opposite.

We can now select to export the drilled-down responses in order to use that information outside of 1E. The picture opposite shows the result of clicking the Export button. In the case of drilled-down responses the exported file is called detailedResults.csv.

Now when we open the file in notepad we can see the names of the devices and the service that is disabled. This can then be passed on to another resource to process those devices to get the service turned on.

Export all results from the completed instruction

To export all results from the completed instruction, follow these steps:

When an instruction has completed, that is when it has finished retrieving answers from the 1E client devices, the Export all results button will appear on the responses page.

Clicking the Export all results button will export your data to Azure blob storage which should be provisioned and configured for you when your tenant is setup.

Once the export has finished, a file named Response_<timestamp>.tsv will be created in the specified share.

You'll notice that exporting in this way includes far more information than the export of the single page shown earlier and the type of data displayed is different.

The single-page export shown earlier contains the processed values, as displayed when viewing the responses page, whereas the .tsv contains all the raw unprocessed data sent back from the 1E client devices.

Exporting device information

The information on the Devices Table page can also be exported to a .csv file, as described in the following steps:

From the Devices Table page, clicking the Export button exports the current page of devices to a file called Devices.csv.

The contents of the Devices.csv can be displayed using Notepad.exe.