Retrieve/download the original source file(s) after a search

[myli12]

Is there an easy way to download/retrieve the original source file via the web interface after finishing a search? It would be convenient to pull the data directly from web interface without going to the data repository via CLI.

[vincentguilbert]

i actually have the same problem. I want to be able to download the original files when it is possible: for instance i index my logs from files not by listening on various port ...

[myli12]

The original data (source) file that contains the search results/events.

[MarioM]

which source file are you talking about?

[lguinn2]

Try using the "show source" button, which is at the left side of each search result near the timestamp.

[araitz]

Those files could be on forwarders, or not even files at all (for example, if the data source is syslog). If you can tell us why you need the entire file, maybe we can better assist you.

[myli12]

The show source gives at most 1000 lines at a time. I am looking for downloading the entire file.