Export data saved to a file in the SumoLogic filesystem
I have had a saved search running for over a year that appends daily data points to a file using the "save append" operator. I can use the cat operator to view the contents of the file, but I can't find a way to actually export it as a CSV. Please help!
David,There's no functionality to export the results directly from the saved content. However, you can run a query against in and then export those results from the results screen:http://help.sumologic.com/Search/Get_Started_with_Search/Search_Basics/Export_Search_Results Alternatively, you can create an index for your results so you can use the lookup operator as well and only select the results you want:http://help.sumologic.com/Search/Search_FAQs/Export_the_Results_of_a_Saved_File Cheers,Mario
Thanks David, you're right, the cat operator did not allow me to export. =( We do have a feature request to export your saved files (https://ideas.sumologic.com/ideas/SL-I-2425). Feel free to vote for it to move it up the priority ladder. In the meantime, I was exploring some options, like indexing every record in your saved file, so we could use the lookup operator to return all results (see http://help.sumologic.com/Search/Search_FAQs/Export_the_Results_of_a_Saved_File) but in your case, you are appending to this saved file, so adding indexes would only append to the new records. Another option I was kicking around is to have your Scheduled Search, instead of save to your file, could instead save to index (http://help.sumologic.com/Dashboards_and_Alerts/Alerts/Save_to_Index). This way, everything you save to this index can be easily queries and exported just by simply querying that index. The downside of this is that it would work going forward, unless you can easily query for the previous time periods to get your year's worth of data. Let mw know if you want more detail. Happy to jump on a screen-share call with you.Cheers,Mario
Please sign in to leave a comment.