How do I export first 5 minutes of a server log?

New Member

Everything I have is always sent to Splunk. We don't have any native files. I have a third party vendor that want the log of the first 5 minutes after my application server started. How can I do that?

Tags (2)
0 Karma


Write a search for the application logs spanning the period you need. Then click the Export icon and choose a format for the export.

If this reply helps you, an upvote would be appreciated.
0 Karma


So, to be even more specific -
1) Identify what source and index your server log is ingested into
2) identify the last time the server was started
3) run the search for that 5 minute timeframe.

Hopefully your logs will be complete, as long as you haven't set up the conf for that kind of data to send unwanted stuff to the nullqueue.

0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!


Or Learn More in Our Blog >>