There are a few ways to do it.
From the GUI, you should also see a "Raw Events" as an export option along with json, xml, and csv.
From the search language, there are several ways to do it as well. Here is one example that will export to a text file, $SPLUNK_HOME/var/run/splunk/results.txt
outputtext usexml=false | rename _xml as raw | fields raw | fields - _* | outputcsv results.txt
I found this post very helpful! 🙂
I have a small question about it. Is there a way how to store the exported file in a different folder? Eg. in /tmp/ ?
Thanks a lot!
NO...! You can't export the
/tmp/ or some other folder, according to the |outputcsv doc
the file will save
But even if you mention results.txt the output would result.txt.csv. I faced the same situation.
The output of the|outputcsv is always .csv ?
I have another question 🙂
Everytime i do that command, a new "results.txt" is created, witch replace (and erase) the last "results.txt". Is it possible to write at the end of this file ?
When i start this search, i'd like the results be added at the end of the file, to have a bigger and bigger file everytime i start the search.
outputcsv doesn't currently support an append. So we use it as an input, add a search to it, and the write the results out again...
|inputcsv results.txt | append [search * | head 10 | outputtext usexml=false | rename _xml as raw | fields raw | fields - _* ] | outputcsv results.txt