|
What's the easiest way to export Splunk search results to a CSV file that I can open in Excel? |
|
If there are fewer than 10,000 lines to export, then "Actions>Export Results..." from the Search or Charting views, after a search has finished running. The menu item is not available on most other dashboards or views. I think that the "Action" menu is nearly invisible, so lots of people miss it. Both of these are good answers, but this one matches more closely what I was trying to do. thanks!
(26 Mar '10, 21:02)
Justin Grant
+1 for 'I think that the "Action" menu is nearly invisible, so lots of people miss it.'!
(10 Apr, 17:39)
pkaeding
|
|
Alternatively, try the splunk > my super cool search | outputcsv mycsvfilename |
|
This is also discussed here: http://blogs.splunk.com/2009/08/07/help-i-cant-export-more-than-10000-events/ What version of Splunk are you running?
(05 Apr '10, 18:12)
gkanapathy ♦
We are on 4.0.9 for now, but will be going to 4.1 shortly. i saw that page you suggested, but have since found that there is a limit of 50,000 lines on the outputscsv. We need to push it to 200-300K lines. thx!
(08 Apr '10, 12:39)
dhaffner
That is strange, I have used outputcsv to generate files over 1 millon results.
(08 Apr '10, 15:50)
gkanapathy ♦
On 4.0.x, that is.
(08 Apr '10, 15:50)
gkanapathy ♦
|
