Wazuh Report Export Issue

[Mr VR]

Hi Team,

I'm facing issue when exporting report in Wazuh.

I have saved search query in two names. I'm unable to export the report with timestamp whereas for other queries I'm able to export all th tables.

One query is exporting the report I want to export without timestamp and other query exports with all the data fields with timestamp.

I request you to support and help to resolve this issue.

Regards,

Vignesh

[Mr VR]

Hi Team,

Hi Team,

I'm facing issue when exporting report in Wazuh 4.14.6.

I have saved search query in two names. I'm unable to export the report with timestamp whereas for other queries I'm able to export all th tables.

One query is exporting the report I want to export without timestamp and other query exports with all the data fields with timestamp.

I request you to support and help to resolve this issue.

Regards,

Vignesh

[Mr VR]

Hi Team,

I removed all the data fields then saved and exported to csv. Now the timestamp is exported with all the data fields. The CSV Report is only possible when I'm exporting without any field selection.

Usually I require agent.ip, rule.description and full_log, timestamp to export CSV. But when I export,  I'm unable to export the selected data field with timestamp.

I request you to help and support on this issue.

Regards,

Vignesh

On Tuesday, 28 July 2026 at 19:11:06 UTC+5:30 Mr VR wrote:

[raul....@wazuh.com]

Hi,

Thank you for the additional information.

From your description, I understand the following behavior:

• When you export the CSV without selecting any fields, the report includes the timestamp along with all available fields.
• However, when you select specific fields (such as agent.ip, rule.description, full_log, and timestamp), the exported CSV does not include the timestamp field.

To help us isolate the cause, could you please verify the following?

1. Are you selecting the timestamp column from the field selector before exporting?
2. Does this behavior occur with a newly created saved search, or only with your existing saved searches?
3. Could you please share a screenshot of the field selection window just before exporting the CSV?
4. If possible, please export using a simple search (for example, the last 10 events) while selecting only timestamp and agent.ip, and let us know if the timestamp is still missing.

This information will help us determine whether the issue is related to the saved search configuration or to the CSV export functionality itself.

We look forward to your findings.

Best regards,

[Mr VR]

Hi Raul,

I have attached the snapshot with this mail.

When I try to export the report with the saved query, Timestamp is not exported. Even if try to add timestamp from the fields, I'm unable to add timestamp field.

1. Are you selecting the timestamp column from the field selector before exporting? Yes, but unable to add Timestamp field. 
2. Does this behavior occur with a newly created saved search, or only with your existing saved searches? In both new and existing creating saved search. Both existing and New Query.
3. Could you please share a screenshot of the field selection window just before exporting the CSV?  Attached.
4. If possible, please export using a simple search (for example, the last 10 events) while selecting only timestamp and agent.ip, and let us know if the timestamp is still missing. Yes, it's still missing

Regards,

Vignesh

[raul....@wazuh.com]

Thank you for the detailed information and the screenshots — that helped us confirm the cause.

This is a known limitation in the CSV reporting engine that Wazuh's dashboard inherits from OpenSearch Dashboards, not an issue specific to your saved searches. When generating a CSV report from Discover, the Timestamp column is not included in the exported file even when it's selected in the field list — this happens regardless of whether the saved search is new or existing, which matches what you tested on your end. 

Two things in the meantime:

1. Workaround: add the id field as a column to your saved search before exporting. The id in the Wazuh alerts index is based on epoch time, so once exported you can convert it to a readable timestamp in Excel/Google Sheets with a formula such as =ID/86400+DATE(1970,1,1). It's not as clean as a native timestamp column, but it lets you recover the event time from the export.
2. Could you confirm which index pattern each of your two saved searches is built on (the one that exports timestamp correctly vs. the one that doesn't), and whether timestamp is set as the designated Time field for both under Stack Management → Index Patterns? Since you're seeing different behavior between two searches on what should be the same data, that's the one variable we'd like to rule out on our end.