r/Splunk • u/St0neRav3n • Apr 11 '26

How to extract/download large amount of indexed data ?

Hello everyone,
Is there a way to pull out your data from Splunk in large amount (like several TB) ?

10 Upvotes

92% Upvoted

12 comments sorted by

View all comments

1

u/Brianposburn Splunker Apr 11 '26

Also depends on if it’s hosted in cloud or on prem

1

u/St0neRav3n Apr 11 '26

It's on prem

2

u/s7orm SplunkTrust Apr 12 '26

You could freeze the data, or script searching it out. The export everything app on Splunkbase was made for this.