Search Manual

Export data using Splunk Web

1. Run a search on your data.

2. Click the export button, located directly below the timeline.

Note: If the button is not visible, it has been hidden by your system administrator to preclude exporting data. For more information, see About defining roles with capabilities in the Securing Splunk Enterprise manual. Look for the export_results_is_visible capability.

3. Select the Format that you want the search results to be exported in. You can select CSV, Raw Events, XML or JSON.

4. Choose the Number of Results you want (Limited or Unlimited).

5. Click Export to confirm.

Extend the session timeout when exporting large amounts of data

When you try to export large amounts of data using the export button, you can run into session timeout issues. Follow this procedure to extend the session timeout limit.

1. Click Settings and select Server Settings.

2. Under Splunk Web, increase the number in the Session timeout field.

Increasing the timeout settings allows Splunk Web more time for the connection between your browser and splunkweb.

Archive search results

If you need to archive your search results, you can export your job data to third-party charting applications. See Export job data to a file.

Schedule reports that send results to stakeholders

You can schedule reports to run on a regular interval and email their results to project stakeholders. The emails can present the report results in inline tables and CSV or PDF attachments. They can also include links to the report results in Splunk Web.

See Schedule Reports in the Reporting Manual.