You can export the results of a log query to share them with other systems, or forward them to your support contact.

Prerequisites

Verify that you are logged in to the vRealize Log Insight web user interface as a user associated with the User role, or a role that has the relevant permissions. For more information, see Create and Modify Roles in Administering vRealize Log Insight. The URL format of the web user interface is https://log_insight-host, where log_insight-host is the IP address or host name of the vRealize Log Insight virtual appliance.

Procedure

  1. In the Explore Logs page, perform the query that you want to export.
  2. Click "" and select Export Event Results.
  3. If your log query has 20,000 results or less, select the format to save the query in and click Export.
    Menu Item Description
    Raw Events Select to save the results in TXT format.
    JSON Select to save the results in JSON format.
    CSV Select to save the results in CSV format.
  4. If your log query has more than 20,000 results, create a task to export the results to an NFS storage path:
    1. Select the format to save the query in, as described in the previous step.
    2. Enter a name for the export task.
    3. Enter the location for the NFS share to which you want to export the results.
    4. To receive an email notification when the export is done, use the toggle button to activate the notification and enter an email address to which the notification is sent. You can send a test email to verify the notification.
    5. Click Export.
    The export task takes some time to finish, depending on the volume of the log query results. If there are multiple export tasks, new tasks are added to a queue and the nodes pick up the tasks from the queue. In the Management > Export page, you can track the progress of the export tasks. If a task is queued, you can see the position of the task in the queue. You can perform the following actions on an ongoing or queued task:
    • Click the stop icon to end the export task.
    • Click the pencil icon to activate or deactivate the email notification on the export completion, or modify the email address to which the notification is sent.
    Administrators and users with the Explore Logs > Export permission can see all the tasks, whereas other users can see only their tasks. When an export task is finished, you can access the NFS share to open the file that contains the results.