Reporting

Export Logs Periodically

simonattardGO
Path Finder

Hi all,

I would like to export logs (in raw format) periodically, eg. everyday or every week. I managed to do this by writing a shell script using the export command.

The thing which I don't like about this command is that every time the export command is run, all the indexed logs are exported. Is there a way how I can export only logs from the past day (or past week etc...) ?

Thanks for your help

Tags (2)
0 Karma
1 Solution

Takajian
Builder

I think it is not necessary to use export command. Can you use just search command and redirect the search result to the file? The search command will be like following in CLI. You can put it in your script and schedule it periodically.

/opt/splunk/bin/splunk search 'sourcetype=access_combined earliest=-7d@d' -maxout 0 > /tmp/test.csv

Hope this help.

View solution in original post

Takajian
Builder

You can use "-maxout 0" parameter. This means no limit number.

Takajian
Builder

I think it is not necessary to use export command. Can you use just search command and redirect the search result to the file? The search command will be like following in CLI. You can put it in your script and schedule it periodically.

/opt/splunk/bin/splunk search 'sourcetype=access_combined earliest=-7d@d' -maxout 0 > /tmp/test.csv

Hope this help.

View solution in original post

suhprano
Path Finder

Do you know what the record/event limit is on that search via cmd line?

0 Karma

alexiobash
New Member

Hi, when run this command i see this message:
Your session is invalid. Please login.

how can i bypass this problem?

0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!