Getting Data In
Highlighted

How to export splunkd.log from 1 system and import to another system again

Splunk Employee
Splunk Employee

I would to export splunkd.log from production and import it into my sandbox for analysis.

Once I export the splunkd.log using raw format, the file is like this.

"01-17-2020 13:53:20.815 +0800 INFO  loader - Splunkd starting (build 2dc56eaf3546)."
"01-17-2020 13:53:20.816 +0800 INFO  loader - Detected 8 (virtual) CPUs, 8 CPU cores, and 7822MB RAM"
"01-17-2020 13:53:20.816 +0800 INFO  loader - Maximum number of threads (approximate): 3911"

It got double quote around the actual raw data.
Any quick method to remove it so that I can add it to my sandbox.

0 Karma

Re: How to export splunkd.log from 1 system and import to another system again

Splunk Employee
Splunk Employee

You can use below awk and sed to remove the leading double quote and trailing double quote.

cat my_splunkd_log.csv | awk '{print substr($0,2);}' | sed 's/.$//' > my_splunkd_log.txt
0 Karma