topic How can I move Splunk logs into an alternative logging solution in Installation

How can I move Splunk logs into an alternative logging solution

kaustubhfab — Thu, 08 May 2014 14:39:29 GMT

Hello, Thank you for having me here.

I have a Enterprise license. I wish to move my existing logs which are in Splunk v5.0.1 into another logging solution.

I logged into Manager > Indexes and found that the in /mnt folder on an EBS. Just thinking out loud: Can I create an API endpoint that requests this data from Splunk?

If not, what alternatives I have to achieve that?

Thank you.

Re: How can I move Splunk logs into an alternative logging solution

aelliott — Thu, 08 May 2014 14:42:33 GMT

Here are some ways that you can achieve this:
http://answers.splunk.com/answers/10749/how-do-i-export-data-out-of-splunk-for-external-reporting

Re: How can I move Splunk logs into an alternative logging solution

kaustubhfab — Mon, 12 May 2014 16:45:09 GMT

Tried this as an example: curl -k -u admin:mypassword --data-urlencode search="search error" -d "output_mode=json" -d "count=10" -d "offset=0" -d "rf=sourcetype=rails" https://localhost:8001/servicesNS/admin/search/search/jobs/export Shouldnt I be getting 10 results? I get thousands of results.