First, select the period of time from which you need to download data using the time range selector.

Click the Download data button on the search window toolbar (alternatively, you can select Additional Tools → Current query → Download data).

Your role must have the Data search download permission assigned in order to see this option in your query. Learn more about role permissions here.

The following table describes the fields in the Download data window:

File name	Enter a name for the file.
Data pathway	Select the data that you want to include in your file: Download from server - Select this option to download all the events from the query, including those that haven't been downloaded to the browser yet. Download current browser content - Select this option to download only the data that has been downloaded to the browser, that is to say, data displayed in the search window. Download to email - Send the query data to your user email. Note that large files may be split and be sent in different emails. Download to S3 - Send the query data to a S3 bucket. You will receive the download URL in your user email.
File format	Choose one of the available formats: CSV - Downloads a .csv file where each event row value is separated by commas. TSV - Downloads a .tsv file where each event row value is separated by a tab character. XLSX - Downloads a .xlsx file where each event row corresponds to an event. JSON Object Array - Downloads a .json file where each event is represented as an object. JSON Matrix - Downloads a .json file where each event is represented as an array. Source - Downloads a .txt file representing the events in their original format.
Date format	Choose the required date format.
Time zone	Specify the required time zone in the text field, or check the box to select the GMT timezone.

The option to download from source isn't available for the following tables: my.parser; my.synthesis; or my.tech.

Click Download when you're done.

Browser not supported