How to export splunkd.log from 1 system and import... - Splunk Community

Getting Data In

I would to export splunkd.log from production and import it into my sandbox for analysis.

Once I export the splunkd.log using raw format, the file is like this.

"01-17-2020 13:53:20.815 +0800 INFO  loader - Splunkd starting (build 2dc56eaf3546)."
"01-17-2020 13:53:20.816 +0800 INFO  loader - Detected 8 (virtual) CPUs, 8 CPU cores, and 7822MB RAM"
"01-17-2020 13:53:20.816 +0800 INFO  loader - Maximum number of threads (approximate): 3911"

It got double quote around the actual raw data.
Any quick method to remove it so that I can add it to my sandbox.

You can use below awk and sed to remove the leading double quote and trailing double quote.

cat my_splunkd_log.csv | awk '{print substr($0,2);}' | sed 's/.$//' > my_splunkd_log.txt

Get Updates on the Splunk Community!

Vibe-coding, AI, and Splunkcraft: Highlights from the .conf26 Builder Bar

If you stopped by the Builder Bar at .conf26, thank you! This year, we brought ...

Thanks for the Memories: .conf26 Took Learning to New Heights

Thank you, Splunk Community, for making .conf26 in Denver one for the books. From packed Splunk University ...

Best Practices: Splunk auto adjust pipeline queue

When you enable autoAdjustQueue in Splunk, maxSize should be understood as the queue size Splunk starts with ...