Export Management allows you to export raw logs from the Search results to a target (storage location) placed on a remote machine. This feature is only available for simple search queries and not for aggregated queries.
Note
The Export Management feature is disabled in the Data Privacy Module enabled systems.
You can create a target either by using the Secure Copy Protocol (SCP) or the File Transfer Protocol (FTP). Before configuring the export management, you need to create a target. To create a target:
Go to Settings >> Configuration from the navigation bar and click Export Management.
Adding a Target¶
Click Add to open the Export panel. Here, you have an option to add the target using either the SCP protocol or the FTP protocol as per the requirement.
For SCP:
Adding SCP Export¶
Provide a Name.
Specify the IP address of the remote machine.
Enter a Port number.
Provide the Username.
Select an Authentication mechanism.
If you selected Password, enter the Password for authentication.
If you selected SSH Certificate, copy the provided key and add it to the authorized keys in the remote machine.
Specify the Path in the target machine.
For FTP:
Adding FTP Export¶
Provide a Name of the export file.
Specify a valid IP address of the remote machine.
Enter a Port number.
Provide the Username and Password recognized by the given IP address.
Specify the Path of the target.
Click Save.
Once you create and configure a target, you can access it via the Export Logs option under the More drop-down from the Search menu. The names of the created targets are populated in the drop-down menu under Search >> More >> Export Logs >> Target. Now, you can export the search results of any search query to any target as per the requirement.
Note
Please refer to the Export Logs in the Search Guide for further details.
Exporting Logs¶
Note
If you have configured SCP Export, multiple lines of the same log are counted as different logs. Therefore, the number of logs in the search results is different from the number of exported logs.
