Reporting

How do you export specific logs from Splunk after searching

aywong
Path Finder

If I find something worth keeping I would like to be able to export the specific event logs that I want and save them somewhere outside of splunk. I would like to not use the coldToFrozenDir if possible?

Tags (1)
0 Karma
1 Solution

bmacias84
Champion

There are a couple of technics depending on what you are trying to accomplish. If you are trying to store the summation of events as counts create summary index using sistats. The other option is to table your results and then export your results using the Export feature which is located top left of the result panel.

Examples


index=_internal deploy | table _raw


index=_internal deploy | table <field1>, <field2>, <field3>

View solution in original post

bmacias84
Champion

There are a couple of technics depending on what you are trying to accomplish. If you are trying to store the summation of events as counts create summary index using sistats. The other option is to table your results and then export your results using the Export feature which is located top left of the result panel.

Examples


index=_internal deploy | table _raw


index=_internal deploy | table <field1>, <field2>, <field3>

bmacias84
Champion

Sorry, for my late reply. You could use sistats then push them in to a index that roles in to Frozen bucket rapidly, by editing your index.conf

0 Karma

aywong
Path Finder

these export the actual logs? I want to save these logs like "coldToFrozenDir" would, but only for specific ones.. that I choose. I'm sorry, I'm very new to this and a little confused.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...