Documentation: 3.3
|  Print Version Contents
This page last updated: 08/11/08 02:08pm

Export event data

Use the export CLI command to copy or archive events from Splunk's indexes. The export command does not remove any data -- it just makes a copy. Since the export command runs on active index files, you must first stop Splunk before you use it.

via the CLI

Note: To use Splunk's CLI, navigate to the $SPLUNK_HOME/bin/ directory and preface CLI commands with ./splunk.

To export events from your Splunk index type into the CLI:

./splunk export eventdata main -dir /copydir [optional search expression]

Note: Type: ./splunk help export to see all of the export command's available arguments and parameters.

Example

Export a subset of events from your index that are from the host "twinkie":

$SPLUNK_HOME/bin/splunk  export eventdata main -dir /copydir host="twinkie"

via Splunk Web

To export data via Splunk Web, run your search and choose Export from the drop-down menu to the left of the search box.

Select the format of the results (txt or CSV) and and the number of events that should be exported.

http://www.splunk.com/assets/doc-images/31_admin_export/exportSave.jpg

Previous: Restore archived data    |    Next: Disk usage

Comments

No comments have been submitted.

Log in to comment.