How to make a report or a CSV file from a search result?

[ofaheem]

Hi,

I want to make a report or a CSV file from a search result. However, the search result is more than 7 million. So now I have a few queries:

• I am trying to save the search; however, whenever I try to open that search to show people how many and what type of events were found, it does not show.
• How can I make a report or CSV file for more than 7 million events?

Please advise.

Thanks & regard,

Osama Faheem

[aasabatini]

Hi @ofaheem 

you can use outputlookup command in your search, there aren't limits.

Or you can follow this article

https://www.splunk.com/en_us/blog/tips-and-tricks/help-i-cant-export-more-than-10000-events.html?_ga...