Getting Data In
Highlighted

Retrieve/download the original source file(s) after a search

Path Finder

Is there an easy way to download/retrieve the original source file via the web interface after finishing a search? It would be convenient to pull the data directly from web interface without going to the data repository via CLI.

Tags (2)
0 Karma
Highlighted

Re: Retrieve/download the original source file(s) after a search

Legend

Try using the "show source" button, which is at the left side of each search result near the timestamp.

Highlighted

Re: Retrieve/download the original source file(s) after a search

Path Finder

The show source gives at most 1000 lines at a time. I am looking for downloading the entire file.

0 Karma
Highlighted

Re: Retrieve/download the original source file(s) after a search

Champion

Those files could be on forwarders, or not even files at all (for example, if the data source is syslog). If you can tell us why you need the entire file, maybe we can better assist you.

Highlighted

Re: Retrieve/download the original source file(s) after a search

Motivator

which source file are you talking about?

0 Karma
Highlighted

Re: Retrieve/download the original source file(s) after a search

Path Finder

The original data (source) file that contains the search results/events.

0 Karma
Highlighted

Re: Retrieve/download the original source file(s) after a search

New Member

i actually have the same problem. I want to be able to download the original files when it is possible: for instance i index my logs from files not by listening on various port ...

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.