Documentation: 3.1
|  Print Version Contents
This page last updated: 11/07/07 03:11pm

Reconstitute Logs

If you use the Splunk data store as your central log repository, the data will not be stored in the original format. If you need to reconstitute your log files (e.g. for compliance, audit, etc.) you will want to export your event data.

Export event data

From the Splunk CLI, use the export command. To use Splunk's CLI, navigate to the $SPLUNK_HOME/bin/ directory and use the ./splunk command. You can also add Splunk to your path and use the splunk command.

  • Stop Splunk:
    • # splunk stop
  • Export data:
    • # splunk export eventdata -index <indexname> -dir <destination_directory> -source <source_to_export> -host <host_to_export> -terms <search terms>

The terms argument is used to search the index and collect the data that should be reconstituted. The terms cannot include complex searches (NOT, maxevents, extracted fields, etc.).

Example:

# splunk export eventdata main -dir /usr/auser/exported_events

This command will create directories under the specified destination corresponding to the the source directories of the requested events, containing files named by source. The exported data is the raw event text. If the original source was a network port, it will be named for the source port. To export subsets of data, append -host <hostname> or -terms "my event search terms" to the command.

CLI search

You can also export events by doing a CLI search and redirecting the output to a file.

# splunk search "source::/var/log/asl.log" > asl.log

Previous: Strip syslog headers before processing    |    Next: Enable HTTPS

Comments

No comments have been submitted.

Log in to comment.