Join the Conversation
- Find Answers
- :
- Using Splunk
- :
- Other Using Splunk
- :
- Reporting
- :
- Export Logs Periodically
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi all,
I would like to export logs (in raw format) periodically, eg. everyday or every week. I managed to do this by writing a shell script using the export command.
The thing which I don't like about this command is that every time the export command is run, all the indexed logs are exported. Is there a way how I can export only logs from the past day (or past week etc...) ?
Thanks for your help
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I think it is not necessary to use export command. Can you use just search command and redirect the search result to the file? The search command will be like following in CLI. You can put it in your script and schedule it periodically.
/opt/splunk/bin/splunk search 'sourcetype=access_combined earliest=-7d@d' -maxout 0 > /tmp/test.csv
Hope this help.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You can use "-maxout 0" parameter. This means no limit number.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I think it is not necessary to use export command. Can you use just search command and redirect the search result to the file? The search command will be like following in CLI. You can put it in your script and schedule it periodically.
/opt/splunk/bin/splunk search 'sourcetype=access_combined earliest=-7d@d' -maxout 0 > /tmp/test.csv
Hope this help.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Do you know what the record/event limit is on that search via cmd line?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi, when run this command i see this message:
Your session is invalid. Please login.
how can i bypass this problem?
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Announcing Modern Navigation: A New Era of Splunk User Experience
Modernize your Splunk Apps – Introducing Python 3.13 in Splunk
Step into “Hunt the Insider: An Splunk ES Premier Mystery” to catch a cybercriminal ...
