Reporting

Export Logs Periodically

simonattardGO
Path Finder

Hi all,

I would like to export logs (in raw format) periodically, eg. everyday or every week. I managed to do this by writing a shell script using the export command.

The thing which I don't like about this command is that every time the export command is run, all the indexed logs are exported. Is there a way how I can export only logs from the past day (or past week etc...) ?

Thanks for your help

Tags (2)
0 Karma
1 Solution

Takajian
Builder

I think it is not necessary to use export command. Can you use just search command and redirect the search result to the file? The search command will be like following in CLI. You can put it in your script and schedule it periodically.

/opt/splunk/bin/splunk search 'sourcetype=access_combined earliest=-7d@d' -maxout 0 > /tmp/test.csv

Hope this help.

View solution in original post

Takajian
Builder

You can use "-maxout 0" parameter. This means no limit number.

Takajian
Builder

I think it is not necessary to use export command. Can you use just search command and redirect the search result to the file? The search command will be like following in CLI. You can put it in your script and schedule it periodically.

/opt/splunk/bin/splunk search 'sourcetype=access_combined earliest=-7d@d' -maxout 0 > /tmp/test.csv

Hope this help.

suhprano
Path Finder

Do you know what the record/event limit is on that search via cmd line?

0 Karma

alexiobash
New Member

Hi, when run this command i see this message:
Your session is invalid. Please login.

how can i bypass this problem?

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...