How can I move Splunk logs into an alternative logging solution

[kaustubhfab]

Hello, Thank you for having me here.

I have a Enterprise license. I wish to move my existing logs which are in Splunk v5.0.1 into another logging solution.

I logged into Manager > Indexes and found that the in /mnt folder on an EBS. Just thinking out loud: Can I create an API endpoint that requests this data from Splunk?

If not, what alternatives I have to achieve that?

Thank you.

[aelliott · Accepted solution]

Here are some ways that you can achieve this:
http://answers.splunk.com/answers/10749/how-do-i-export-data-out-of-splunk-for-external-reporting

[kaustubhfab]

Tried this as an example: curl -k -u admin:mypassword --data-urlencode search="search error" -d "output_mode=json" -d "count=10" -d "offset=0" -d "rf=sourcetype=rails" https://localhost:8001/servicesNS/admin/search/search/jobs/export Shouldnt I be getting 10 results? I get thousands of results.