Splunk Times out on large Data Export of Table

[itsmevic]

Hello, Splunk is timing out after I try and use the export feature in UI.  There is quite a bit of data that needs to be exported.  Is there a way to keep it from timing out?

[The_Simko]

This is where the session timeout field comes into play. Settings > Server Settings > General Settings.  Then in the Splunk Web section change the Session Timeout.

Now, if that still doesn't work you always have some options like using |outputlookup to write the data as a .csv and then pick it up. Obviously it only works for certain types of data, and requires you to be able to access the CLI to get a copy of the data, but it may work for some uses.

Another thing to try would be use to REST API to export, like shown in this post from Discovered Intelligence: https://discoveredintelligence.ca/get-data-out-of-splunk/#:~:text=A%20user%20can%20call%20the,on%2Dp...