How to extract events

[ravi_shah01]

Hi,

I have a requirement to extract all the events in a file.

Example:

For an order number, there are around 100 events. I need to provide all the events in the text file (any extension) and send it across to my analysis team for investigation of an issue.

Can you please let me know as to how can we achieve this?

[gkanapathy]

This is too specific and vague to answer. I think you should become more familiar with more general abilities of Splunk (asking general questions as necessary here) rather than simply posting your low-level requirements, which doesn't let us know any context about what level of detail the answers should be in. For example, the high-level answer would be "index your file into Splunk and query for the order number". But I'm sure that's not the point.

[dskillman]

It would be helpful to see a sample of the data to get an idea of what you need. Sounds like there are 100 events with a common order number. If that is the case, is there any commonality in how the order number is written to each event. At a minimum you should be able to simply search for the order number and get all of the events in question and export the events.