Splunk Search

Export raw logs from specific time

tb582
Explorer

I have a specific source type and hosts that I want to export the raw logs for the past 24h is there a way to do that via the ui as I do not have admin access.

Labels (1)
Tags (2)
0 Karma

ianmaddox4bookr
Explorer

Here's a gzipped dump of everything past a certain timestamp that you run from the linux command line:

sudo /opt/splunk/bin/splunk search "sourcetype=apache_access _time > 1335337200" -preview 0 -maxout 0 -output rawdata | gzip > access_custom.apr-may2012.gz

vnguyen46
Contributor

This is a good scripting approach to export large search results.
This is another example of scripting: splunk search "index=_internal earliest=09/14/2014:23:59:00 latest=09/16/2014:01:00:00 " -output rawdata -maxout 200000 > c:/test123.dmp

Thanks,

0 Karma

shawngarrettsgp
Path Finder

Yeah agreed, the "table _raw" solution did not work for me at all in 6.2.0, it looks like it would by populating stats but when I hit "export" then did csv it just gave me a file of timestamps.

Following the CLI export example though got it done.
http://docs.splunk.com/Documentation/Splunk/6.3.3/Search/Exportsearchresults

0 Karma

Damien_Dallimor
Ultra Champion

Perform your search on required sourcetype(s) and host(s)

Then navigate to Export -> Export Results

Choose Format=Raw Events and click on "Export" to save a txt file of the raw events.

There is "Max # of results to export " option where you can select "unlimited"

Damien_Dallimor
Ultra Champion

There is "Max # of results to export " option where you can select "unlimited"

Note : Splunk 4.3

0 Karma

tb582
Explorer

Only exports 10k lines that's no good

Damien_Dallimor
Ultra Champion

You can do something like this to roughly achieve what you are trying to do via Splunk Web.

Replace sourcetype and host with your actual search values.

sourcetype=foo host=goo | table _raw | outputcsv rawdump.csv

The file will get written to $SPLUNK_HOME/var/run/splunk

tb582
Explorer

But I still need access to that location on the spunk server? Seems like it would be a simple thing for slunk to be able to do. Often times its nessicary to send logs to the third party app developers so that they cam diagnose issues.

Get Updates on the Splunk Community!

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...

Ready, Set, SOAR: How Utility Apps Can Up Level Your Playbooks!

 WATCH NOW Powering your capabilities has never been so easy with ready-made Splunk® SOAR Utility Apps. Parse ...