Splunk Enterprise

Raw data back to files

ankithreddy777
Contributor

Is there a way to convert all the raw data of a particular index to a file.

We have ingested data from files to splunk. The rawdata of that index is over 500GB. We would like to convert the raw data back to files and store data on other external storages for other purpose. Is it possible to do so.

Tags (2)
0 Karma

hardikJsheth
Motivator

Easiest way would be, Run a python script which runs splunk search , fetches data and put it into file.

gcusello
SplunkTrust
SplunkTrust

Hi ankithreddy777,
you can run a search like

index=myindex

and then use the export button (on the high right) choosing the "raw data" option as export format (the other are csv, xml and json).
Otherwise you can add the outputtext command to the previous search (see https://docs.splunk.com/Documentation/Splunk/6.6.2/SearchReference/Outputtext ) but in this case you export index on the server.
Bye.
Giuseppe

Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...