How do I export first 5 minutes of a server log?

[sebtardif]

Everything I have is always sent to Splunk. We don't have any native files. I have a third party vendor that want the log of the first 5 minutes after my application server started. How can I do that?

[richgalloway]

Write a search for the application logs spanning the period you need. Then click the Export icon and choose a format for the export.

[DalJeanis]

So, to be even more specific -
1) Identify what source and index your server log is ingested into
2) identify the last time the server was started
3) run the search for that 5 minute timeframe.

Hopefully your logs will be complete, as long as you haven't set up the conf for that kind of data to send unwanted stuff to the nullqueue.