Getting Data In

How to archive specific logs

aywong
Path Finder

If I find something worth keeping I would like to be able to archive the specific event logs that I want and save them somewhere outside of splunk.

coldToFrozenDir, determines the behavior when cold rolls to frozen and archives the frozen buckets in the specified directory, but I only want to archive specific logs, at random.

for example if I do a search and find a log that I would like to just keep, how do I just keep that one.

Tags (3)
0 Karma
1 Solution

sowings
Splunk Employee
Splunk Employee

The easiest way to do what you're asking is to export the results using the "export" button in the search view, print it, or "save search and results".

coldToFrozenDir works at the bucket (subdivision of an index) level, and it's unlikely that you could archive a particular piece of log segment in a single bucket (not without a lot of other things in that bucket, too).

You could also consider saving just the "_raw" field of the events found by your search. This would work for the export functionality, too. When you're satisfied with the search expression to get the results you want, add | table _raw at the end, then export the results when the search finishes.

View solution in original post

sowings
Splunk Employee
Splunk Employee

The easiest way to do what you're asking is to export the results using the "export" button in the search view, print it, or "save search and results".

coldToFrozenDir works at the bucket (subdivision of an index) level, and it's unlikely that you could archive a particular piece of log segment in a single bucket (not without a lot of other things in that bucket, too).

You could also consider saving just the "_raw" field of the events found by your search. This would work for the export functionality, too. When you're satisfied with the search expression to get the results you want, add | table _raw at the end, then export the results when the search finishes.

Ayn
Legend

You could use the collect command to grab the search results for some search with interesting results and write those results to a separate index that has a much longer retention time than your main index.

peter_krammer
Communicator

The problem with this method is that the fields source, sourcetype and host are overridden.
It would be better if there was an option to archive data or mark data as don't delete until you do not need them anymore.
We have to sometimes keep specific Data for further analysis and do not know how long we need to keep them.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...