Getting Data In

Recreate an indexed 'source' file

ironhalo
Explorer

Is there a way to extract the entire source file from the splunk index?

Tags (4)
0 Karma

rroberts
Splunk Employee
Splunk Employee

Check the splunk export command.

./splunk export eventdata -index main -dir /tmp/events -host www -sourcetype syslog -terms "dhcp OR bind"

0 Karma

mw
Splunk Employee
Splunk Employee

Can you explain more about the use-case? There isn't a single file once it's indexed within Splunk. But, you can conduct an appropriate search and then click on the little down arrow to the left of the timestamp and click "View Source" to see the raw events.

ironhalo
Explorer

The process in question continually generates a lot of log information, once the log file reaches a certain size it's written over. I've tried to 'view source', but it returns an error. I figured the next best solution would be to try and re create the log file entirely. These log files can be tens of thousands of lines.

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

REGISTER NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If ...

Observability | Use Synthetic Monitoring for Website Metadata Verification

If you are on Splunk Observability Cloud, you may already have Synthetic Monitoringin your observability ...

More Ways To Control Your Costs With Archived Metrics | Register for Tech Talk

Tuesday, May 14, 2024  |  11AM PT / 2PM ET Register to Attend Join us for this Tech Talk and learn how to ...