Preview Tool

Cisco Bug: CSCtc36976 - CS-MARS: Custom column reports exported to CSV format missing sessions

Last Modified

Sep 11, 2015

Products (1)

  • Cisco Security Monitoring, Analysis and Response System

Known Affected Releases


Description (partial)


When creating a custom column report and choosing .csv as the result format, the finished .csv file will contain only the unexpanded sessions.  It will be missing the categorized sub-sessions that is available in the report.


Here is one way that this can occur:

1.  Create a query in MARS.
2.  For "query type" click on the "edit" button and select "Customer Columns ranked by time"
3.  For custom columns select two of the following headings:
    "source address and port" 
    "destination address, port and protocol"
4.  Choose a time frame that will achieve plenty of results.
5.  Fill out other fields in a way that will be helpful to receive many sessions.
6.  perform query and make sure you have plenty of data.
7.  Save the query as a report and choose the "result format" to be .csv when prompted in the wizard dialog.
8.  Optional you can have it email the report to yourself.
9.  Run the report and in the .csv results you will notice that only the unexpanded sessions will be available, all the detailed sub-sessions will not appear.  The main report when run on MARS, the non-csv format will have everything properly.

The key is to have session data in a custom column report and the result format set to "csv".
Bug details contain sensitive information and therefore require a account to be viewed.

Bug Details Include

  • Full Description (including symptoms, conditions and workarounds)
  • Status
  • Severity
  • Known Fixed Releases
  • Related Community Discussions
  • Number of Related Support Cases
Bug information is viewable for customers and partners who have a service contract. Registered users can view up to 200 bugs per month without a service contract.