Exporting Data
You can export your data in different formats to a local file.
Click
above the main panel and choose :Figure 69. Export Data
In the Export to File dialog, choose a from the dropdown menu:
@rawstring field in a
. Exports the.txt
file. You are required to enter a name for the exported file..csv
file. You are required to enter a name for the exported file and to specify the fields to export e.g., @host, @timestamp separated by commas..ndjson
file. The event dataset consists of @rawstring and all other fields in the event such as repo, type, @id and any fields created during ingest parsing and/or searching. You are required to enter a name for the exported file. Use this format to get a streamable JSON file, with each event on a single line as a single JSON object:JSON{"name":"storage-download","alloc":"16","cputime":"72270","#repo":"humio","#humioAutoShard":"0","class":"c.h.u.TimerExecutor$","@timestamp.nanos":"0","@rawstring":"2022-03-02T12:00:32.543+0000 [storage-download-1] INFO c.h.u.TimerExecutor$ 1 - Job completed: name=storage-download cputime=72270 wallclock=78600 alloc=16","wallclock":"78600","@timestamp":1646222432543,"@ingesttimestamp":"1646222432545","source":"console.log","#type":"humio","#vhost":"1","thread":"storage-download-1","@host":"localhost:8080","@timezone":"Z","#kind":"logs","@id":"VfLBYh9oqH58Brx69sux0JRl_53_912_1646222432","loglevel":"INFO"} {"name":"delete-local-segments","alloc":"64","cputime":"45756","#repo":"humio","#humioAutoShard":"3","class":"c.h.u.TimerExecutor$","@timestamp.nanos":"0","@rawstring":"2022-03-02T12:00:32.405+0000 [delete-local-segments-1] INFO c.h.u.TimerExecutor$ 1 - Job completed: name=delete-local-segments cputime=45756 wallclock=50500 alloc=64","wallclock":"50500","@timestamp":1646222432405,"@ingesttimestamp":"1646222432406","source":"console.log","#type":"humio","#vhost":"1","thread":"delete-local-segments-1","@host":"localhost:8080","@timezone":"Z","#kind":"logs","@id":"0LYr06NkzENWQDoXeYKl6k2R_40_887_1646222432","loglevel":"INFO"}
@rawstring, repo, type, @id etc.) in a
. Exports the entire dataset (.json
file. You are required to enter a name for the exported file. Use this format to get one entire JSON record, with one JSON array where each element of the array is a JSON object for the event:JSON[{"name":"storage-download","alloc":"16","cputime":"72270","#repo":"humio","#humioAutoShard":"0","class":"c.h.u.TimerExecutor$","@timestamp.nanos":"0","@rawstring":"2022-03-02T12:00:32.543+0000 [storage-download-1] INFO c.h.u.TimerExecutor$ 1 - Job completed: name=storage-download cputime=72270 wallclock=78600 alloc=16","wallclock":"78600","@timestamp":1646222432543,"@ingesttimestamp":"1646222432545","source":"console.log","#type":"humio","#vhost":"1","thread":"storage-download-1","@host":"localhost:8080","@timezone":"Z","#kind":"logs","@id":"VfLBYh9oqH58Brx69sux0JRl_53_912_1646222432","loglevel":"INFO"}, {"name":"delete-local-segments","alloc":"64","cputime":"45756","#repo":"humio","#humioAutoShard":"3","class":"c.h.u.TimerExecutor$","@timestamp.nanos":"0","@rawstring":"2022-03-02T12:00:32.405+0000 [delete-local-segments-1] INFO c.h.u.TimerExecutor$ 1 - Job completed: name=delete-local-segments cputime=45756 wallclock=50500 alloc=64","wallclock":"50500","@timestamp":1646222432405,"@ingesttimestamp":"1646222432406","source":"console.log","#type":"humio","#vhost":"1","thread":"delete-local-segments-1","@host":"localhost:8080","@timezone":"Z","#kind":"logs","@id":"0LYr06NkzENWQDoXeYKl6k2R_40_887_1646222432","loglevel":"INFO"}, ... ]
Enter a name for the exported file.
Click
.
Note
If your search is aggregate, the exported events would normally reflect the same order as the UI. Conversely, non-aggregate queries will return a streaming export with unordered events.