I would like to export logs (in raw format) periodically, eg. everyday or every week. I managed to do this by writing a shell script using the export command.
The thing which I don't like about this command is that every time the export command is run, all the indexed logs are exported. Is there a way how I can export only logs from the past day (or past week etc...) ?
Thanks for your help
asked 05 Dec '11, 05:40
I think it is not necessary to use export command. Can you use just search command and redirect the search result to the file? The search command will be like following in CLI. You can put it in your script and schedule it periodically.
/opt/splunk/bin/splunk search 'sourcetype=access_combined earliest=-7d@d' -maxout 0 > /tmp/test.csv
Hope this help.
answered 07 Dec '11, 23:58
You can use "-maxout 0" parameter. This means no limit number.
answered 12 Jan '12, 15:23