Splunk® Enterprise

Search Manual

Download manual as PDF

This documentation does not apply to the most recent version of Splunk. Click here for the latest version.
Download topic as PDF

Share jobs and export results

You can share a job with other Splunk users, or export the event data to archive or to use with a third-party charting application.

Share a job with others

When you share a job, you are sharing the results of a specific run of a search.

There are several ways that you can share a specific job with other Splunk users. You can change the permissions for a search job to share that job with other users. You can also share a job by sending the URL for a search job to a Splunk user.

You can only change permissions or share a link to the current job.

Change job permissions

You can share a job by changing the permissions on that job. By default, all jobs are "Private".

  1. From the Job menu, select Edit Job Settings to display the Job Settings dialog box.
  2. Change Read Permissions to Everyone.
  3. Click Save.
This screen image shows the Job Settings dialog box.

Share a job URL

You can quickly share a job with other Splunk users by sending them a link to the job. This is handy when you want another user to see the results returned by the job.

The users that you send the link to should also have permissions to use the app that the job belongs to.

Decide which method you want to use to obtain a job link. You can use the Share icon or the Job menu.

  1. To use the Share icon:
    1. Click the icon. The Share icon is one of the search action icons.
    2. In the Link To Job text box, copy the URL and send the link to the users you want to share the job results with.
    The permissions on the job are automatically changed to "Everyone" and the lifetime of the job is automatically extended to "7 days".
    This screen image shows the Share Jobs dialog box and the Share icon. The Share icon is a curved arrow pointing to the right.
  2. To use the Job menu:
    1. From the Job menu, select Edit Job Settings to display the Job Settings dialog box.
    2. Change Read Permissions to Everyone. If the permissions for a job are set to "Private", other users cannot access the job with the link.
    3. Change Lifetime to 7 days.
    4. Copy the link and send the link to the users you want to share the job results with.
6.4 job settings dialog.png

You can also save the link for your own use. Click and drag the bookmarks icon to the bookmarks bar in your Web browser.

Export job results to a file

You can export the event data from a search or pivot job to a CSV, XML, JSON, or raw data file. You can then archive the file or use the file with a third-party charting application.

  1. Run a search.
  2. Select the Export icon. The export icon is one of the search actions icons.
  3. This screen image shows the export icon, which appears as an arrow pointing down with a line underneath.
  4. Click Format and select from the list of file formats.
  5. In the File Name field, type a name for the export file. The export file is created to store the event data.
  6. This screen image shows the Export Results dialog box. The choices in the dialog box are Format, File Name, and Number of Results.
  7. Indicate whether the number of results that you are exporting to this file should be Unlimited or Limited.
  8. You can set a limit for the number of events you want to export, or you can go ahead and export all the results returned by your search or pivot. Some searches return enormous numbers of events. Take precautions as necessary for your situation.
  9. Click Export to save the job events in the export file.
  10. The file is saved in the default download directory for your browser or operating system. For example, for most Windows and Mac OSX users the export file appears in the default Downloads directory, if you have not specified a different directory as your default download directory. On Linux, check the XDG configuration file for the download directory.

    There are other methods that you can use to export search results. Some are optimized for speed, while others are good for extremely large event sets. For a summary of these export methods, see Export search results.

PREVIOUS
Extending job lifetimes
  NEXT
Manage search jobs

This documentation applies to the following versions of Splunk® Enterprise: 6.2.0, 6.2.1, 6.2.2, 6.2.3, 6.2.4, 6.2.5, 6.2.6, 6.2.7, 6.2.8, 6.2.9, 6.2.10, 6.2.11, 6.2.12, 6.2.13, 6.2.14, 6.2.15, 6.3.0, 6.3.1, 6.3.2, 6.3.3, 6.3.4, 6.3.5, 6.3.6, 6.3.7, 6.3.8, 6.3.9, 6.3.10, 6.3.11, 6.3.12, 6.3.13, 6.3.14, 6.4.0, 6.4.1, 6.4.2, 6.4.3, 6.4.4, 6.4.5, 6.4.6, 6.4.7, 6.4.8, 6.4.9, 6.4.10, 6.4.11


Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters