dump
The dump
command is an internal, unsupported, experimental command. See
About internal commands.
Description
For Splunk Enterprise deployments, export search results to a set of chunk files on local disk. For information about other export methods, see Export search results in the Search Manual.
This command is considered risky because, if used incorrectly, it can pose a security risk or potentially lose data when it runs. As a result, this command triggers SPL safeguards. See SPL safeguards for risky commands in Securing the Splunk Platform.
Syntax
dump basefilename=<string> fields=<comma-delimited-string> [rollsize=<number>] [compress=<number>] [format=<string>] [fields=<comma-delimited-string>]
Required arguments
- basefilename
- Syntax: basefilename=<string>
- Description: The prefix of the export filename.
- fields
- Syntax: fields=<comma-delimited-string>
- Description: A list of the fields to be exported. The entire list must be enclosed in quotation marks. Invalid field names are ignored.
Optional arguments
- compress
- Syntax: compress=<number>
- Description: The gzip compression level. Specify a number from 0 to 9, where 0 means no compression and a higher number means more compression and slower writing speed.
- Default: 2
- format
- Syntax: format= raw | csv | tsv | json | xml
- Description: The output data format.
- Default: raw
- rollsize
- Syntax: rollsize=<number>
- Description: The maximum file size, in MB, at which point no more events are written to the file and it becomes a candidate for HDFS transfer.
- Default: 63 MB
Usage
This command exports events to a set of chunk files on local disk at "$SPLUNK_HOME/var/run/splunk/dispatch/<sid>/dump". This command recognizes a special field in the input events, _dstpath
, which if set is used as a path to be appended to the dst
directory to compute the final destination path.
The dump
command preserves the order of events as the events are received by the command.
Examples
Example 1: Export all events from index "bigdata" to the location "YYYYmmdd/HH/host" at "$SPLUNK_HOME/var/run/splunk/dispatch/<sid>/dump/" directory on local disk with "MyExport" as the prefix of export filenames. Partitioning of the export data is achieved by eval preceeding the dump command.
index=bigdata | eval _dstpath=strftime(_time, "%Y%m%d/%H") + "/" + host | dump basefilename=MyExport
Example 2: Export all events from index "bigdata" to the local disk with "MyExport" as the prefix of export filenames.
index=bigdata | dump basefilename=MyExport
collapse | findkeywords |
This documentation applies to the following versions of Splunk® Enterprise: 8.1.0, 8.1.1, 8.1.2, 8.1.3, 8.1.4, 8.1.5, 8.1.6, 8.1.7, 8.1.8, 8.1.9, 8.1.10, 8.1.11, 8.1.12, 8.1.13, 8.1.14, 8.2.0, 8.2.1, 8.2.2, 8.2.3, 8.2.4, 8.2.5, 8.2.6, 8.2.7, 8.2.8, 8.2.9, 8.2.10, 8.2.11, 8.2.12
Feedback submitted, thanks!