Getting Data In

How to export splunkd.log from 1 system and import to another system again

daniel_splunk
Splunk Employee
Splunk Employee

I would to export splunkd.log from production and import it into my sandbox for analysis.

Once I export the splunkd.log using raw format, the file is like this.

"01-17-2020 13:53:20.815 +0800 INFO  loader - Splunkd starting (build 2dc56eaf3546)."
"01-17-2020 13:53:20.816 +0800 INFO  loader - Detected 8 (virtual) CPUs, 8 CPU cores, and 7822MB RAM"
"01-17-2020 13:53:20.816 +0800 INFO  loader - Maximum number of threads (approximate): 3911"

It got double quote around the actual raw data.
Any quick method to remove it so that I can add it to my sandbox.

0 Karma

daniel_splunk
Splunk Employee
Splunk Employee

You can use below awk and sed to remove the leading double quote and trailing double quote.

cat my_splunkd_log.csv | awk '{print substr($0,2);}' | sed 's/.$//' > my_splunkd_log.txt
0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Preparing your Splunk Environment for OpenSSL3

The Splunk platform will transition to OpenSSL version 3 in a future release. Actions are required to prepare ...

Self-Healing Pipeline Is Now Generally Available: AI-Powered CIM Compliance

Maintaining data integrity across security and analytics pipelines is an ongoing challenge. Data ...

[Puzzles] Solve, Learn, Repeat: Family Trees

This puzzle (first published here is based on finding grandparents and grandchildren (inspired by a question ...