How do I export first 5 minutes of a server log?

New Member

Everything I have is always sent to Splunk. We don't have any native files. I have a third party vendor that want the log of the first 5 minutes after my application server started. How can I do that?

Tags (2)
0 Karma


Write a search for the application logs spanning the period you need. Then click the Export icon and choose a format for the export.

If this reply helps you, an upvote would be appreciated.
0 Karma


So, to be even more specific -
1) Identify what source and index your server log is ingested into
2) identify the last time the server was started
3) run the search for that 5 minute timeframe.

Hopefully your logs will be complete, as long as you haven't set up the conf for that kind of data to send unwanted stuff to the nullqueue.

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!