When you run a search query, the result is stored as a job in the Splunk server. While this job was created by one specific user, it can be shared across with other users so that they can start using this result set without the necessity of building the query for it again. The results can also be exported and saved as files which can be shared with users who do not use Splunk.

Sharing the Search Result

Once a query has run successfully, we can see a small upward arrow in the middle right of the web page. Clicking on this icon gives a URL where the query and the result can be accessed. There is a need to grant permission to the users who will be using this link. Permission is granted through the Splunk administration interface.

Finding the Saved Results

The jobs that are saved to be used by all users with appropriate permissions can be located by looking for the jobs link under the activity menu in the top right bar of the Splunk interface. In the below image, we click on the highlighted link named jobs to find the saved jobs.

After the above link is clicked, we get the list of all the saved jobs as shown below. He, we have to note that there is an expiry date post where the saved job will automatically get removed from Splunk. You can adjust this date by selecting the job and clicking on Edit selected and then choosing Extend Expiration.

Exporting the Search Result

We can also export the results of a search into a file. The three different formats available for export are: CSV, XML and JSON. Clicking on the Export button after choosing the formats downloads the file from the local browser into the local system. This is explained in the below image −

So, this brings us to the end of blog. This Tecklearn ‘How to share and export the search result in Splunk’ helps you with commonly asked questions if you are looking out for a job in Splunk and Big Data Domain.

If you wish to learn Splunk and build a career in Splunk or Big Data domain, then check out our interactive, Splunk Developer and Admin Training, that comes with 24*7 support to guide you throughout your learning period. Please find the link for course details:

https://www.tecklearn.com/course/splunk-training-and-certification-developer-and-admin/

Splunk Developer & Admin Training

About the Course

Tecklearn’s Splunk Training covers all aspects of Splunk development and Splunk administration from basic to expert level. The trainee will go through various aspects of Splunk installation, configuration, etc. and also learn to create reports and dashboards, both using Splunk’s searching and reporting commands. As part of the course, also work on Splunk deployment management, indexes, parsing, Splunk cluster implementation, and more. With this online Splunk training, you can quickly get up and run with the Splunk platform and successfully clear the Splunk Certification exam.

Why Should you take Splunk Developer and Admin Training?

Splunk Development Operations Engineer can pocket home salaries of upto $148,590. -Indeed.com
13,000+ customers in over 110 countries are already using Splunk to gain operational intelligence & reduce operational cost.
IDC predicts by 2020, world will be home to 40 trillion GB data. The demand to process this data is higher than ever.

What you will Learn in this Course?

Splunk Administration

Overview of Splunk

Need for Splunk and its features
Splunk Products and their Use-Case
Splunk Components: Search Head, Indexer, Forwarder, Deployment Server & License Master
Splunk Licensing options

Splunk Architecture

Introduction to the architecture of Splunk

Splunk Installation

Download and Install Splunk
Configure Splunk
Creation of index

Splunk Configuration Files

Introduction to Splunk configuration files
Managing the. conf files

Splunk App and Apps Management

Splunk App
How to develop Splunk apps
Splunk App Management
Splunk App add-ons
App permissions and Implementation

User roles and authentication

Introduction to Authentication techniques
User Creation and Management
Splunk Admin Roles and Responsibilities
Splunk License Management

Splunk Index Management

Splunk Indexes
Segregation of the Splunk Indexes
Concept of Splunk Buckets and Bucket Classification
Creating New Index and estimating Index storage

Various Splunk Input Methods

Understanding the input methods
Agentless input types

Splunk Universal Forwarder

Universal Forwarder management
Overview of Splunk Universal Forwarder

Deployment Management in Splunk

Implementing the Splunk tool and deploying it on server
Splunk environment setup and Splunk client group deployment

Basic Production Environment

Universal Forwarder
Forwarder Management
Data management
Troubleshooting and Monitoring

Splunk Search Engine

Integrating Search using Head Clustering and Indexer Clustering
Conversion of machine-generated data to operational intelligence
Set up Dashboard, Charts and Reports

Search Scaling and Monitoring

Splunk Distributed Management Console for monitoring
Large-scale deployment and overcoming execution hurdles
Distributed search concepts
Improving search performance

Splunk Cluster Implementation and Index Clustering

Cluster indexing
Configuring the cluster behaviour
Index and search behaviour

Distributed Management Console

Introduction to Splunk distributed management console
How to deploy distributed search in Splunk environment

Splunk Developer

Splunk Development Concepts

Roles and Responsibilities of Splunk developer

Basic Searching

Basic Searching using Splunk query
Build Search, refine search and time range using Auto-complete
Controlling a search job and Identifying the contents of search

Using Fields in Searches

Using Fields in search
Deployment of Field Extractor and Fields Sidebar for REGEX field extraction

Splunk Search Commands

Search command
General search practices
Concept of search pipeline
Specify indexes in search
Deployment of the various search commands: Fields, Sort, Tables, Rename, rex and erex

Creating Reports and Dashboards

Creation of Reports, Charts and Dashboards
Editing Dashboards and Reports
Adding reports to dashboard

Creating Alerts

Create alerts
Understanding alerts
Viewing fired alerts

Splunk Commands

Splunk Search Commands
Transforming Commands
Reporting Commands
Mapping and Single Value Commands

Lookups

Concept of data lookups, examples and lookup tables

Automatic Lookups

Configuring and Defining automatic lookups
Deploying lookups in reports and searches

Splunk Queries

Splunk Queries
Splunk Query Repository

Splunk Search Processing Language

Learn about the Search Processing Language

Analyzing, Calculating and Formatting results

Calculating and analysing results
Value conversion
Conditional statements and filtering calculated search results

Splunk Reports and Visualizations

Explore the available visualizations
Create charts and time charts
Omit null values and format results

Got a question for us? Please mention it in the comments section and we will get back to you.

424