Export Management allows you to export raw logs from Search results to a target storage location on a remote Logpoint. You can export raw logs from simple search queries, not aggregated queries. If you have Data Privacy applied, you can’t export raw data.
Important
Export Management is not available in SaaS.
You can create a target either by using Secure Copy Protocol (SCP) or File Transfer Protocol (FTP). Before configuring Export Management, you need to create a target. To create a target:
Go to Settings >> Configuration from the navigation bar and click Export Management.
Click ADD and select either SCP protocol or FTP protocol to add the target.
For SCP:
Enter a Name.
Enter the IP address of the remote Logpoint.
Enter a Port number.
Enter the Username.
Select an Authentication protocol.
If you select Password, enter the authentication Password.
If you select SSH Certificate, copy the provided key and add it to authorized keys in the remote Logpoint.
Enter the Path of the target Logpoint.
Adding SCP Export¶
Click Save.
For FTP:
Enter a Name of the export file.
Enter the IP address of the remote Logpoint.
Enter a Port number.
Enter the Username and Password recognized by the given IP address.
Enter the Path of the target Logpoint.
Adding FTP Export¶
Click Save.
To access the created and configured target, go to Search from the navigation bar, click the More dropdown and click Export Logs. The names of the created targets are listed in the dropdown menu under Search >> More >> Export Logs >> Target. You can export the search results of any search query to any target as per the requirement. Go to Export Logs in the Search Guide for more information.
Exporting Logs¶
If you have configured SCP Export, multiple lines of the same log are counted as different logs. Therefore, the number of logs in the search results is different from the number of exported logs.
Job Status displays the Name, Type, Status, and Remarks of the export log status with their Actions.
Export Job Status¶
Go to Settings >> Configuration from the navigation bar and click Export Management.
Click the Delete (
) icon under Actions.
To delete multiple exports, select the exports, click the MORE dropdown, and select Delete Selected.
To delete all the exports, click the MORE dropdown and select Delete All.
Export Management¶
Click Yes.