Getting Data In

How to export splunkd.log from 1 system and import to another system again

daniel_splunk
Splunk Employee
Splunk Employee

I would to export splunkd.log from production and import it into my sandbox for analysis.

Once I export the splunkd.log using raw format, the file is like this.

"01-17-2020 13:53:20.815 +0800 INFO  loader - Splunkd starting (build 2dc56eaf3546)."
"01-17-2020 13:53:20.816 +0800 INFO  loader - Detected 8 (virtual) CPUs, 8 CPU cores, and 7822MB RAM"
"01-17-2020 13:53:20.816 +0800 INFO  loader - Maximum number of threads (approximate): 3911"

It got double quote around the actual raw data.
Any quick method to remove it so that I can add it to my sandbox.

0 Karma

daniel_splunk
Splunk Employee
Splunk Employee

You can use below awk and sed to remove the leading double quote and trailing double quote.

cat my_splunkd_log.csv | awk '{print substr($0,2);}' | sed 's/.$//' > my_splunkd_log.txt
0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

From Raw Data to Executive-Ready Stories, Faster

Build Data Stories for Every Audience  A dashboard is rarely just a dashboard. It might be the view an ...

Guided Onboarding with Auto-schema Is Now Generally Available

  We are excited to announce the General Availability of Guided Onboarding with Auto-Schematization ...

ATTENTION: We’re Moving! (AGAIN!)

The Splunk Community Slack is undergoing a system migration to keep our workspace secure and ...