Exporting Data

You can export your data in different formats to a local file.

  1. Click Save as... above the main panel and choose Export to file:

    Export Data

    Figure 75. Export Data


  2. In the Export to File dialog, choose a File Type from the dropdown menu:

    • Plain text. Exports the @rawstring field in a .txt file. You are required to enter a name for the exported file.

    • CSV. Exports a selection of fields in a .csv file. You are required to enter a name for the exported file and to specify the fields to export e.g., @host, @timestamp separated by commas.

    • Newline delimited JSON. Exports the entire event dataset in a .ndjson file. The event dataset consists of @rawstring and all other fields in the event such as repo, type, @id and any fields created during ingest parsing and/or searching. You are required to enter a name for the exported file. Use this format to get a streamable JSON file, with each event on a single line as a single JSON object:

      JSON
      {"name":"storage-download","alloc":"16","cputime":"72270","#repo":"humio","#humioAutoShard":"0","class":"c.h.u.TimerExecutor$","@timestamp.nanos":"0","@rawstring":"2022-03-02T12:00:32.543+0000 [storage-download-1] INFO  c.h.u.TimerExecutor$ 1 - Job completed: name=storage-download cputime=72270 wallclock=78600 alloc=16","wallclock":"78600","@timestamp":1646222432543,"@ingesttimestamp":"1646222432545","source":"console.log","#type":"humio","#vhost":"1","thread":"storage-download-1","@host":"localhost:8080","@timezone":"Z","#kind":"logs","@id":"VfLBYh9oqH58Brx69sux0JRl_53_912_1646222432","loglevel":"INFO"}
{"name":"delete-local-segments","alloc":"64","cputime":"45756","#repo":"humio","#humioAutoShard":"3","class":"c.h.u.TimerExecutor$","@timestamp.nanos":"0","@rawstring":"2022-03-02T12:00:32.405+0000 [delete-local-segments-1] INFO  c.h.u.TimerExecutor$ 1 - Job completed: name=delete-local-segments cputime=45756 wallclock=50500 alloc=64","wallclock":"50500","@timestamp":1646222432405,"@ingesttimestamp":"1646222432406","source":"console.log","#type":"humio","#vhost":"1","thread":"delete-local-segments-1","@host":"localhost:8080","@timezone":"Z","#kind":"logs","@id":"0LYr06NkzENWQDoXeYKl6k2R_40_887_1646222432","loglevel":"INFO"}

    • JSON. Exports the entire dataset (@rawstring, repo, type, @id etc.) in a .json file. You are required to enter a name for the exported file. Use this format to get one entire JSON record, with one JSON array where each element of the array is a JSON object for the event:

      JSON
      [{"name":"storage-download","alloc":"16","cputime":"72270","#repo":"humio","#humioAutoShard":"0","class":"c.h.u.TimerExecutor$","@timestamp.nanos":"0","@rawstring":"2022-03-02T12:00:32.543+0000 [storage-download-1] INFO  c.h.u.TimerExecutor$ 1 - Job completed: name=storage-download cputime=72270 wallclock=78600 alloc=16","wallclock":"78600","@timestamp":1646222432543,"@ingesttimestamp":"1646222432545","source":"console.log","#type":"humio","#vhost":"1","thread":"storage-download-1","@host":"localhost:8080","@timezone":"Z","#kind":"logs","@id":"VfLBYh9oqH58Brx69sux0JRl_53_912_1646222432","loglevel":"INFO"},
{"name":"delete-local-segments","alloc":"64","cputime":"45756","#repo":"humio","#humioAutoShard":"3","class":"c.h.u.TimerExecutor$","@timestamp.nanos":"0","@rawstring":"2022-03-02T12:00:32.405+0000 [delete-local-segments-1] INFO  c.h.u.TimerExecutor$ 1 - Job completed: name=delete-local-segments cputime=45756 wallclock=50500 alloc=64","wallclock":"50500","@timestamp":1646222432405,"@ingesttimestamp":"1646222432406","source":"console.log","#type":"humio","#vhost":"1","thread":"delete-local-segments-1","@host":"localhost:8080","@timezone":"Z","#kind":"logs","@id":"0LYr06NkzENWQDoXeYKl6k2R_40_887_1646222432","loglevel":"INFO"},
...
]

  3. Enter a name for the exported file.

  4. Click Export.

Note

If your search is aggregate, the exported events would normally reflect the same order as the UI. Conversely, non-aggregate queries will return a streaming export with unordered events.