Getting Data In

How to extract events

ravi_shah01
Engager

Hi,

I have a requirement to extract all the events in a file.

Example:

For an order number, there are around 100 events. I need to provide all the events in the text file (any extension) and send it across to my analysis team for investigation of an issue.

Can you please let me know as to how can we achieve this?

Tags (1)
0 Karma

gkanapathy
Splunk Employee
Splunk Employee

This is too specific and vague to answer. I think you should become more familiar with more general abilities of Splunk (asking general questions as necessary here) rather than simply posting your low-level requirements, which doesn't let us know any context about what level of detail the answers should be in. For example, the high-level answer would be "index your file into Splunk and query for the order number". But I'm sure that's not the point.

dskillman
Splunk Employee
Splunk Employee

It would be helpful to see a sample of the data to get an idea of what you need. Sounds like there are 100 events with a common order number. If that is the case, is there any commonality in how the order number is written to each event. At a minimum you should be able to simply search for the order number and get all of the events in question and export the events.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...