Build data from index

[thirumalreddyb]

Hi,

I have an interesting question put by my client. Here in this case splunk listens to a port and starts indexing the streaming data. Now that an index is built and there is no physical storage of files(Source), the other tools want to access the physical files. How do I build physical files AUTOMATICALLY from the index.

Note : I tried exporting the results of a search MANUALLY and that worked fine irrespective of the file size. Please correct me for the size factor.

Thanks in advance.

[somesoni2 · Accepted solution]

Alternatively, if you looking for some script automation for the same, you can use curl command to execute and export the search result (preferred for large no of rows). This command is availabe in Linux/Unix and downloadable versions available for windows.

curl -k -u adminUserName:password https://<<yourHostName:8089/services/search/jobs/export --data-urlencode search='search <<your base search>> | table index,host,source,sourcetype,_raw' -d output_mode=csv -d earliest_time='-2d@d' -d latest_time='-1d@d' -o <<yourfilename>>.csv

[thirumalreddyb]

Thank you. I was exactly looking for something like this.

[lukejadamec]

You could create a search that ends with

| table _time,_raw | outputcsv csvfilename

This will create a csv file in the splunk\var\run\splunk directory that includes the raw data.

http://docs.splunk.com/Documentation/Splunk/6.0/SearchReference/Outputcsv

[thirumalreddyb]

Thanks for your time. I really appreciate.