Export Logs Periodically

[simonattardGO]

Hi all,

I would like to export logs (in raw format) periodically, eg. everyday or every week. I managed to do this by writing a shell script using the export command.

The thing which I don't like about this command is that every time the export command is run, all the indexed logs are exported. Is there a way how I can export only logs from the past day (or past week etc...) ?

Thanks for your help

[Takajian]

You can use "-maxout 0" parameter. This means no limit number.

[Takajian · Accepted solution]

I think it is not necessary to use export command. Can you use just search command and redirect the search result to the file? The search command will be like following in CLI. You can put it in your script and schedule it periodically.

/opt/splunk/bin/splunk search 'sourcetype=access_combined earliest=-7d@d' -maxout 0 > /tmp/test.csv

Hope this help.

[suhprano]

Do you know what the record/event limit is on that search via cmd line?

[alexiobash]

Hi, when run this command i see this message:
Your session is invalid. Please login.

how can i bypass this problem?