Exporting Data

You can export your data in different formats to a local file.

  1. In the Results panel click Save (upper right corner) and select Export to file.

    Export Data

    Figure 80. Export Data


  2. In the appearing Export to file dialog box, select one of the following file types:

    • CSV. Exports a selection of fields in a .csv file. The Fields to export option allows selecting field names that are suggested based on the query results, or enabling the Select all checkbox to have them all.

      Suggested Fields to Export in CSV

      Figure 81. Suggested Fields to Export in CSV


    • JSON. Exports the entire dataset (@rawstring, #repo, #type, @id etc.) in a .json file. Use this format to get one entire JSON record, with one JSON array where each element of the array is a JSON object for the event.

    • Newline delimited JSON. Exports the entire event dataset in a .ndjson file. The event dataset consists of @rawstring and all other fields in the event such as #repo, #type, @id and any fields created during ingest parsing and/or searching. Use this format to get a streamable JSON file, with each event on a single line as a single JSON object:

      JSON
      {"name":"storage-download","alloc":"16","cputime":"72270","#repo":"humio","#humioAutoShard":"0","class":"c.h.u.TimerExecutor$","@timestamp.nanos":"0","@rawstring":"2022-03-02T12:00:32.543+0000 [storage-download-1] INFO  c.h.u.TimerExecutor$ 1 - Job completed: name=storage-download cputime=72270 wallclock=78600 alloc=16","wallclock":"78600","@timestamp":1646222432543,"@ingesttimestamp":"1646222432545","source":"console.log","#type":"humio","#vhost":"1","thread":"storage-download-1","@host":"localhost:8080","@timezone":"Z","#kind":"logs","@id":"VfLBYh9oqH58Brx69sux0JRl_53_912_1646222432","loglevel":"INFO"}
{"name":"delete-local-segments","alloc":"64","cputime":"45756","#repo":"humio","#humioAutoShard":"3","class":"c.h.u.TimerExecutor$","@timestamp.nanos":"0","@rawstring":"2022-03-02T12:00:32.405+0000 [delete-local-segments-1] INFO  c.h.u.TimerExecutor$ 1 - Job completed: name=delete-local-segments cputime=45756 wallclock=50500 alloc=64","wallclock":"50500","@timestamp":1646222432405,"@ingesttimestamp":"1646222432406","source":"console.log","#type":"humio","#vhost":"1","thread":"delete-local-segments-1","@host":"localhost:8080","@timezone":"Z","#kind":"logs","@id":"0LYr06NkzENWQDoXeYKl6k2R_40_887_1646222432","loglevel":"INFO"}

    • Plain text. Exports the @rawstring field in a .txt file.

  3. Enter a name for the exported file (required).

  4. Click Export.

When exporting data:

  • If your search is aggregate, the exported events would normally reflect the same order as the User Interface. Conversely, non-aggregate queries will return a streaming export with unordered events.

  • When exporting timestamp fields, such as @timestamp, the data is exported as the integer value of the timestamp, not a formatted value as may be displayed within the Search UI. To export the information with a formatted date or time, add a field to the events, using formatTime() to output a formatted version of the timestamp. For example, adding:

    logscale
    formatTime(format="%Y-%m-%d", as=fmtted)

    Will add a date to each event.