Join the Conversation
- Find Answers
- :
- Using Splunk
- :
- Other Using Splunk
- :
- Reporting
- :
- How do you export specific logs from Splunk after ...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
If I find something worth keeping I would like to be able to export the specific event logs that I want and save them somewhere outside of splunk. I would like to not use the coldToFrozenDir if possible?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
There are a couple of technics depending on what you are trying to accomplish. If you are trying to store the summation of events as counts create summary index using sistats. The other option is to table your results and then export your results using the Export feature which is located top left of the result panel.
Examples
index=_internal deploy | table _raw
index=_internal deploy | table <field1>, <field2>, <field3>
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
There are a couple of technics depending on what you are trying to accomplish. If you are trying to store the summation of events as counts create summary index using sistats. The other option is to table your results and then export your results using the Export feature which is located top left of the result panel.
Examples
index=_internal deploy | table _raw
index=_internal deploy | table <field1>, <field2>, <field3>
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Sorry, for my late reply. You could use sistats then push them in to a index that roles in to Frozen bucket rapidly, by editing your index.conf
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
these export the actual logs? I want to save these logs like "coldToFrozenDir" would, but only for specific ones.. that I choose. I'm sorry, I'm very new to this and a little confused.
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
[Puzzles] Solve, Learn, Repeat: Matching cron expressions
Design, Compete, Win: Submit Your Best Splunk Dashboards for a .conf26 Pass
May 2026 Splunk Expert Sessions: Security & Observability
