topic Re: How do you export specific logs from Splunk after searching in Reporting

How do you export specific logs from Splunk after searching

aywong — Fri, 28 Sep 2012 14:26:31 GMT

If I find something worth keeping I would like to be able to export the specific event logs that I want and save them somewhere outside of splunk. I would like to not use the coldToFrozenDir if possible?

Re: How do you export specific logs from Splunk after searching

bmacias84 — Mon, 28 Sep 2020 12:31:46 GMT

There are a couple of technics depending on what you are trying to accomplish. If you are trying to store the summation of events as counts create summary index using sistats. The other option is to table your results and then export your results using the Export feature which is located top left of the result panel.

Examples



index=_internal deploy | table _raw



index=_internal deploy | table <field1>, <field2>, <field3>

Re: How do you export specific logs from Splunk after searching

aywong — Thu, 11 Oct 2012 15:20:07 GMT

these export the actual logs? I want to save these logs like "coldToFrozenDir" would, but only for specific ones.. that I choose. I'm sorry, I'm very new to this and a little confused.

Re: How do you export specific logs from Splunk after searching

bmacias84 — Thu, 25 Oct 2012 15:20:44 GMT

Sorry, for my late reply. You could use sistats then push them in to a index that roles in to Frozen bucket rapidly, by editing your index.conf