Splunk Enterprise Security

Export all search results to CSV when search uses head

rroyko
New Member

I am trying to create a dashboard with a search that shows the top 10 entries but I also need to be able to export all the results

0 Karma

asneed_eu
Path Finder

The export option is underneath the time picker, and you should be able to choose csv.

You may want to filter your fields with the table command.

For example:
index=_internal | table source sourcetype event_message | head 10

Or, some other "transforming" command.

Ex:
index=_internal | top sourcetype

0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!