Documentation: 3.2.3
|  Print Version Contents
This page last updated: 04/09/08 10:04am

Export event data

You can use the export command to selectively copy or archive events from Splunk's indexes. The export command does not remove any data -- it just makes a copy. Since the export command runs on active index files, you must first stop Splunk.

via the CLI

To use Splunk's CLI, navigate to the $SPLUNK_HOME/bin/ directory and use the ./splunk command. You can also add Splunk to your path and use the splunk command.

The command is:

# splunk export eventdata main -dir /copydir [optional search expression]

This command copies all events from the main index to the directory /copydir. The events are placed in a directory structure similar to $SPLUNK_DB.
{export-dir}/{path to splunk install}/var/spool/splunk/{source name...}.

For example, 
/copydir/opt/splunk31/splunk/var/spool/splunk/sourcefile.log

Search terms can be added to the command to select a subset of data. For example, 
$SPLUNK_HOME/bin/splunk  export eventdata main -dir /copydir host::twinkie

via Splunk Web

To use Splunk Web, run your search and select Export from the search menu

http://www.splunk.com/assets/doc-images/31_admin_export/exportMenu.jpg

Select the format of the results (txt or CSV) and and the number of events that should be exported.

http://www.splunk.com/assets/doc-images/31_admin_export/exportSave.jpg

Previous: Restore archived data    |    Next: Disk usage

Comments

  1. In our current configuration, the Export Search As menu is disabled and I don't get an option to export as csv or text. Is there a changed in configuration that is required to enable the menu??
    Posted by alok on Jul 09 2008, 9:54am

Log in to comment.