Getting Data In

How to archive specific logs

aywong
Path Finder

If I find something worth keeping I would like to be able to archive the specific event logs that I want and save them somewhere outside of splunk.

coldToFrozenDir, determines the behavior when cold rolls to frozen and archives the frozen buckets in the specified directory, but I only want to archive specific logs, at random.

for example if I do a search and find a log that I would like to just keep, how do I just keep that one.

Tags (3)
0 Karma
1 Solution

sowings
Splunk Employee
Splunk Employee

The easiest way to do what you're asking is to export the results using the "export" button in the search view, print it, or "save search and results".

coldToFrozenDir works at the bucket (subdivision of an index) level, and it's unlikely that you could archive a particular piece of log segment in a single bucket (not without a lot of other things in that bucket, too).

You could also consider saving just the "_raw" field of the events found by your search. This would work for the export functionality, too. When you're satisfied with the search expression to get the results you want, add | table _raw at the end, then export the results when the search finishes.

View solution in original post

sowings
Splunk Employee
Splunk Employee

The easiest way to do what you're asking is to export the results using the "export" button in the search view, print it, or "save search and results".

coldToFrozenDir works at the bucket (subdivision of an index) level, and it's unlikely that you could archive a particular piece of log segment in a single bucket (not without a lot of other things in that bucket, too).

You could also consider saving just the "_raw" field of the events found by your search. This would work for the export functionality, too. When you're satisfied with the search expression to get the results you want, add | table _raw at the end, then export the results when the search finishes.

Ayn
Legend

You could use the collect command to grab the search results for some search with interesting results and write those results to a separate index that has a much longer retention time than your main index.

peter_krammer
Communicator

The problem with this method is that the fields source, sourcetype and host are overridden.
It would be better if there was an option to archive data or mark data as don't delete until you do not need them anymore.
We have to sometimes keep specific Data for further analysis and do not know how long we need to keep them.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...