topic Re: export raw logs from splunk in Reporting

export raw logs from splunk

paymon — Thu, 19 Aug 2010 01:57:38 GMT

if i wanted to get a copy of the uncooked or raw syslogs from splunk how would i do that?

exporttool seems to only export csv and not raw syslogs.

Re: export raw logs from splunk

Lowell — Thu, 19 Aug 2010 02:05:48 GMT

Have you looked over the following docs?

Re: export raw logs from splunk

piebob — Thu, 19 Aug 2010 03:00:41 GMT

this might also be useful. it's not 'raw' syslog, but you can forward the data in syslog format: http://www.splunk.com/base/Documentation/latest/Admin/Forwarddatatothird-partysystems

Re: export raw logs from splunk

Lowell — Thu, 19 Aug 2010 04:52:36 GMT

Thanks for the edit piebob, looks like I have 'logs' on the brain. 😉

Re: export raw logs from splunk

piebob — Thu, 19 Aug 2010 05:00:27 GMT

there are worse things to have on the brain... 🙂

Re: export raw logs from splunk

Stephen_Sorkin — Thu, 19 Aug 2010 08:00:00 GMT

Given your reference to exporttool, I'd imagine that the other answers here aren't quite right, as they deal with streaming data out at the same time it's indexed.

You probably want to look at the export capabilities added to CLI search in version 4.1. A CLI search like the following will stream all events out of the index to standard out, and can be piped into other programs or redirected into other files:

splunk search '*' -maxout 0
splunk search '*' -maxout 0 | wc -l
splunk search '*' -maxout 0 > exportfile.txt

You can replace the '*' here with any search on keywords or fields. In fact, as long as the search is non-transforming (no stats, sort, timechart, top, ...) you can use other search commands like lookup, eval, where, regex.

Re: export raw logs from splunk

gkanapathy — Thu, 19 Aug 2010 10:18:56 GMT

And of course you can still use ./splunk export rather than exporttool.

Re: export raw logs from splunk

maverick — Wed, 30 Mar 2011 20:29:07 GMT

You can run a search to bring back all of the raw events that you would like to export over the time range that is appropriate.

then append this to the end of our search:

| table _raw | outputcsv

The outputcsv file containing your results should be in $SPLUNK_HOME/var/run/splunk/ directory.

Re: export raw logs from splunk

jabineer — Tue, 09 Jun 2015 19:38:35 GMT

Addendum to Maverick's words of wisdom...

Add a filename after outputcsv and find it in $SPLUNK_HOME/var/run/splunk/ directory.

...| table _raw | outputcsv mySearch.csv

Re: export raw logs from splunk

PvandenHondel — Mon, 28 Aug 2017 11:46:31 GMT

Addendum 2:

Add

...| table _raw | outputcsv output.raw

to your query and find the result file output.raw in the directory

$SPLUNK_HOME/var/run/splunk/csv