https://community.splunk.com/t5/Reporting/Unable-to-filter-CLI-export/m-p/106601#M2454 <P>Hello!</P> <P>I'm trying to export a subset of logs indexed on one indexer, and then import them into another. I'm attempting to use the cli export tool to do this, and am running into issues.</P> <P>If I run the following:</P> <P><CODE>./splunk export eventdata -index main -dir /tmp/export</CODE> </P> <P>then I get a successful export of everything that has been indexed by the server. Unfortunately, this is far more data than I actually want to export. To try and narrow it down, I'm using further export flags, but they don't appear to be working at all. I'm trying to get a specific set of log files from specific hosts. </P> <P>Using commands like the following:</P> <P><CODE>./splunk export eventdata -index main -dir /tmp/export -host HOSTNAME</CODE> </P> <P><CODE>./splunk export eventdata -index main -dir /tmp/export -source LOGFILEPATH</CODE> </P> <P>I simply get nothing exported. I've verified that the host name and logfile info is correct, so I'm at a loss as to what is causing it to return nothing. I am assuming that the -host flag is used to denote the forwarder that the logs originated from, and that the -source is the full path of the logfile. (Ex: 'D:\apache-tomcat-6.0.32\bin\server.log'. I have tried it both escaped and not) </P> <P>Has anyone else run into this issue?</P> <P>Thanks!</P> Tue, 08 Nov 2011 18:50:43 GMT emiller42 2011-11-08T18:50:43Z https://community.splunk.com/t5/Reporting/Unable-to-filter-CLI-export/m-p/106601#M2454 <P>Hello!</P> <P>I'm trying to export a subset of logs indexed on one indexer, and then import them into another. I'm attempting to use the cli export tool to do this, and am running into issues.</P> <P>If I run the following:</P> <P><CODE>./splunk export eventdata -index main -dir /tmp/export</CODE> </P> <P>then I get a successful export of everything that has been indexed by the server. Unfortunately, this is far more data than I actually want to export. To try and narrow it down, I'm using further export flags, but they don't appear to be working at all. I'm trying to get a specific set of log files from specific hosts. </P> <P>Using commands like the following:</P> <P><CODE>./splunk export eventdata -index main -dir /tmp/export -host HOSTNAME</CODE> </P> <P><CODE>./splunk export eventdata -index main -dir /tmp/export -source LOGFILEPATH</CODE> </P> <P>I simply get nothing exported. I've verified that the host name and logfile info is correct, so I'm at a loss as to what is causing it to return nothing. I am assuming that the -host flag is used to denote the forwarder that the logs originated from, and that the -source is the full path of the logfile. (Ex: 'D:\apache-tomcat-6.0.32\bin\server.log'. I have tried it both escaped and not) </P> <P>Has anyone else run into this issue?</P> <P>Thanks!</P> Tue, 08 Nov 2011 18:50:43 GMT https://community.splunk.com/t5/Reporting/Unable-to-filter-CLI-export/m-p/106601#M2454 emiller42 2011-11-08T18:50:43Z https://community.splunk.com/t5/Reporting/Unable-to-filter-CLI-export/m-p/106602#M2455 <P>Yeah, I'm seeing this as well on version 2.4.3. It turns out this is a known issue (SPL-45694) and it's currently being investigated.</P> Thu, 15 Dec 2011 16:37:42 GMT https://community.splunk.com/t5/Reporting/Unable-to-filter-CLI-export/m-p/106602#M2455 alexiri 2011-12-15T16:37:42Z https://community.splunk.com/t5/Reporting/Unable-to-filter-CLI-export/m-p/106603#M2456 <P>I tested following commands with 4.3.3 release and both work fine:<BR /> splunk export eventdata -index main -dir /temp/events.out -source 'C:\work\test\test.log'<BR /> splunk export eventdata -index main -dir /temp/raven -host 'raven-PC'</P> Fri, 06 Jul 2012 20:02:15 GMT https://community.splunk.com/t5/Reporting/Unable-to-filter-CLI-export/m-p/106603#M2456 xli_splunk 2012-07-06T20:02:15Z