I have a splunk container running on docker, and was hoping to translate the raw splunk index data into json using a cli search and saving the output as a local file. How to do this?
Thanks in advance!
1 Answers
The CLI command is (surprise!) search.
splunk search "your SPL query" -maxout 0 -output json -wrap 0 > local_file
The -maxout 0 option allows an unlimited number of events in the output, however, the output size is still limited to 50k. See https://docs.splunk.com/Documentation/Splunk/9.0.1/SearchReference/CLIsearchsyntax for all of the available options.
Related