How to export your data from Splunk

Splunk lets you export the results of a search, report, or pivot as Raw Events, CSV, JSON, XML, or PDF directly from Splunk Web, or pull larger/scheduled exports programmatically via the CLI, REST API, or an SDK.

Formats: CSV, JSON, XML, PDF, Raw EventsPlan: Any Splunk Enterprise or Splunk Cloud Platform license — export is a built-in platform feature, not a paid add-onRole: A role whose capabilities include export/search access; the Export button can be hidden by an admin. Extending the session timeout for large exports requires the edit_server capability (Splunk Enterprise only)

✓ Verified against Splunk's official documentation, September 2026

Step by step

1Run the search, report, or pivot whose results you want to export in Splunk Web.
2Click the Export button, one of the Search action buttons above the results.
3In the Export Results dialog, click Format and choose Raw Events, CSV, JSON, XML, or PDF (available formats depend on the job artifact type).
4Optional: enter a value in Number of Results to cap how many events are exported; leave it blank to export everything.
5Optional: enter a name in the File Name field for the downloaded file.
6Click Export. If the underlying search job artifact doesn't hold the full result set, Splunk reruns the search before producing the file.
7For large, high-volume, or scheduled exports, skip Splunk Web and use the CLI or a GET request against the REST API /results or /export endpoint with output_mode set to csv, json, json_cols, json_rows, xml, atom, or raw.
8For repeatable/automated export pipelines, build against one of the Splunk SDKs instead of calling the REST API directly.

What the export includes

✓The events/rows returned by the specific search, report, or pivot you exported
✓Fields and calculated fields shown in the results table
✓Full raw event text when you choose the Raw Events format

What it doesn't include

✗The underlying raw index buckets or a full data/instance backup — export works on search results, not the index itself
✗Knowledge object definitions (dashboards, saved searches, alerts) — you get the data they return, not the objects
✗Users, roles, and app/platform configuration
✗Anything an admin has restricted: if the Export button isn't visible, an administrator has disabled it for your role

Before you start

⚠If the search job's stored artifact doesn't contain the complete result set, Splunk Web reruns the search before exporting, which adds time for large jobs
⚠Large exports triggered from the Export button can hit the Splunk Web session timeout before the download finishes
⚠Only Splunk Enterprise admins with the edit_server capability can raise the session timeout (Settings > Server Settings > General Settings); this workaround is not available on Splunk Cloud Platform
⚠PDF export only applies to saved searches/reports run through Splunk Web, not ad-hoc raw-event exports
⚠For high-volume or recurring exports, Splunk's own docs recommend the CLI or SDKs over the Export button, and note the REST API is 'recommended only for internal use' rather than as a primary export path

Where to take your data

Free and cheaper tools that can take a Splunk export. See all Splunk alternatives →

Graylog

Ship the exported CSV/JSON events into Graylog via its GELF HTTP input or a file/CSV input, mapping fields to Graylog message fields, or forward live data going forward using a Splunk-to-Graylog forwarder instead of one-off exports.

Elasticsearch (ELK Stack)

Alternatives

Bulk-load exported JSON (json_rows/json output_mode) into an Elasticsearch index using the _bulk API or Logstash's file/JSON input, then rebuild dashboards in Kibana.

Grafana Loki

Convert exported CSV/JSON events into log lines with timestamps and labels, then push them into Loki with Promtail's file target or the Loki push API for historical backfill.

Exporting from Splunk: common questions

Can I export my entire Splunk index, not just search results?+

Splunk's export tooling (Splunk Web, CLI, REST API, SDKs) exports the results of a search, report, or pivot, not a raw copy of the index. To move all indexed data, you'd need to run a search that matches everything (e.g., a broad time range with no filters) and export that, or use Splunk's backup/migration tooling for the underlying buckets.

What's the difference between exporting via Splunk Web and via the REST API?+

Splunk Web's Export button is best for a single, low-volume, on-demand download. Splunk's docs recommend the CLI for large exports and the SDK/REST API for higher-volume, scheduled, or automated exports.

Why is the Export button missing from my search results?+

An administrator can hide the Export button for your role to prevent data export; if you don't see it, ask your Splunk admin to enable export capability for your account.

My export times out on large result sets — how do I fix that?+

Large exports through the Export button can exceed the Splunk Web session timeout. On Splunk Enterprise, a user with the edit_server capability can raise the timeout under Settings > Server Settings > General Settings; this option isn't available on Splunk Cloud Platform, so use the CLI or REST API for big jobs instead.

Which export formats does Splunk support?+

Splunk Web supports Raw Events, CSV, JSON, XML, and PDF (PDF only for saved searches/reports). The REST API additionally supports atom, json_cols, and json_rows output modes.

Can I schedule recurring exports out of Splunk?+

Yes — Splunk's docs point to the SDK and REST API as the right tools for higher-volume, scheduled exports, since the Web UI Export button is designed for one-off, interactive downloads.