Are you a member of the Splunk Community?
- Find Answers
- :
- Using Splunk
- :
- Other Using Splunk
- :
- Reporting
- :
- Export Logs Periodically
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi all,
I would like to export logs (in raw format) periodically, eg. everyday or every week. I managed to do this by writing a shell script using the export command.
The thing which I don't like about this command is that every time the export command is run, all the indexed logs are exported. Is there a way how I can export only logs from the past day (or past week etc...) ?
Thanks for your help
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I think it is not necessary to use export command. Can you use just search command and redirect the search result to the file? The search command will be like following in CLI. You can put it in your script and schedule it periodically.
/opt/splunk/bin/splunk search 'sourcetype=access_combined earliest=-7d@d' -maxout 0 > /tmp/test.csv
Hope this help.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You can use "-maxout 0" parameter. This means no limit number.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I think it is not necessary to use export command. Can you use just search command and redirect the search result to the file? The search command will be like following in CLI. You can put it in your script and schedule it periodically.
/opt/splunk/bin/splunk search 'sourcetype=access_combined earliest=-7d@d' -maxout 0 > /tmp/test.csv
Hope this help.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Do you know what the record/event limit is on that search via cmd line?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi, when run this command i see this message:
Your session is invalid. Please login.
how can i bypass this problem?
Tech Talk Recap | Mastering Threat Hunting
Observability for AI Applications: Troubleshooting Latency
Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?
