https://community.splunk.com/t5/Getting-Data-In/How-to-extract-events/m-p/13185#M1150 <P>It would be helpful to see a sample of the data to get an idea of what you need. Sounds like there are 100 events with a common order number. If that is the case, is there any commonality in how the order number is written to each event. At a minimum you should be able to simply search for the order number and get all of the events in question and export the events.</P> Mon, 10 May 2010 11:14:46 GMT dskillman 2010-05-10T11:14:46Z https://community.splunk.com/t5/Getting-Data-In/How-to-extract-events/m-p/13184#M1149 <P>Hi,</P> <P>I have a requirement to extract all the events in a file.</P> <P>Example:</P> <P>For an order number, there are around 100 events. I need to provide all the events in the text file (any extension) and send it across to my analysis team for investigation of an issue.</P> <P>Can you please let me know as to how can we achieve this?</P> Mon, 10 May 2010 09:04:57 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-extract-events/m-p/13184#M1149 ravi_shah01 2010-05-10T09:04:57Z https://community.splunk.com/t5/Getting-Data-In/How-to-extract-events/m-p/13185#M1150 <P>It would be helpful to see a sample of the data to get an idea of what you need. Sounds like there are 100 events with a common order number. If that is the case, is there any commonality in how the order number is written to each event. At a minimum you should be able to simply search for the order number and get all of the events in question and export the events.</P> Mon, 10 May 2010 11:14:46 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-extract-events/m-p/13185#M1150 dskillman 2010-05-10T11:14:46Z https://community.splunk.com/t5/Getting-Data-In/How-to-extract-events/m-p/13186#M1151 <P>This is too specific and vague to answer. I think you should become more familiar with more general abilities of Splunk (asking general questions as necessary here) rather than simply posting your low-level requirements, which doesn't let us know any context about what level of detail the answers should be in. For example, the high-level answer would be "index your file into Splunk and query for the order number". But I'm sure that's not the point.</P> Mon, 10 May 2010 12:07:24 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-extract-events/m-p/13186#M1151 gkanapathy 2010-05-10T12:07:24Z