Microsoft Sentinel
Cloud and workloadsExport Splunk Data to Target Platform
In brief
The article’s title, metadata, introductory guidance, and section heading were updated. The introduction now explicitly states that historical Splunk data should be exported in CSV format before migration to Azure.
What Defender admins need to know
Administrators get clearer guidance on the export format and migration sequence. No administrator action is specified.
Summaries are generated from the documentation change itself.
Documentation change
View on Microsoft LearnThe comparison below shows only the changed extract. Use the full-page view for complete context.
title: Export Splunk dataData to target platformTarget Platform
titleSuffix: Microsoft Sentinel
description: Learn how to export your historical data from Splunk for a Microsoft Sentinel migration of security monitoring use cases.
author: EdB-MSFT
ms.author: edbaynash
ms.topic: how-to
ms.date: 06/15/07/01/2026
ai-usage: ai-assisted
ms.custom: msecd-doc-authoring-10141016
#Customer intent: As a security engineer, I want to export historical data from Splunk so that I can migrate it to Microsoft Sentinel for analysis and storage.
Export historical data from Splunk
This article describes howUse these methods to export your historical data from Splunk.Splunk in CSV format before migrating it to Azure. After you complete the steps in this article,export your data, you can select a target Azure platform for your exported historical data, and then select a data ingestion tool for migrating historical data.
:::image type="content" source="media/migration-export-ingest/export-data.png" alt-text="Diagram illustrating steps involved in export and ingestion." border="false":::
You can export data from Splunk in several ways. Your selection of an export method depends on the data volumes involved and your level of interactivity. For example, exporting a single, on-demand search via Splunk Web might be appropriate for a low-volume export. Alternatively, if you want to set up a higher-volume, scheduled export, the SDK and REST options work best.
For large exports, the most stable method for data retrieval is dump or the Command Line Interface (CLI). You can export the logs to a local folder on the Splunk server or to another server accessible by Splunk.
To export your historical data from Splunk, use one of the Splunk export methods. The output format should be CSV.
CLI example
This CLI command exports data recorded between 23:59 and 01:00 on September 14, 2021 to a CSV file:
splunk search "index=_internal earliest=09/14/2021:23:59:00 latest=09/16/2021:01:00:00 " -output csv > c:/data.csv
dump example
This dump command exports all events from the bigdata index to the YYYYmmdd/HH/host location under the $SPLUNK_HOME/var/run/splunk/dispatch/<sid>/dump/ directory on a local disk. The command uses MyExport as the prefix for export filenames, and outputs the results to a CSV file. The command partitions the exported data using the eval function before the dump command.
index=bigdata | eval _dstpath=strftime(_time, "%Y%m%d/%H") + "/" + host | dump basefilename=MyExport format=csv
Next stepsRelated content
@@ -1,13 +1,13 @@ ----title: Export Splunk data to target platform+title: Export Splunk Data to Target Platform titleSuffix: Microsoft Sentinel description: Learn how to export your historical data from Splunk for a Microsoft Sentinel migration of security monitoring use cases. author: EdB-MSFT ms.author: edbaynash ms.topic: how-to-ms.date: 06/15/2026+ms.date: 07/01/2026 ai-usage: ai-assisted-ms.custom: msecd-doc-authoring-1014+ms.custom: msecd-doc-authoring-1016 #Customer intent: As a security engineer, I want to export historical data from Splunk so that I can migrate it to Microsoft Sentinel for analysis and storage.@@ -16,15 +16,15 @@ ms.custom: msecd-doc-authoring-1014 # Export historical data from Splunk -This article describes how to export your historical data from Splunk. After you complete the steps in this article, you can [select a target Azure platform for your exported historical data](migration-ingestion-target-platform.md), and then [select a data ingestion tool for migrating historical data](migration-ingestion-tool.md).+Use these methods to export historical data from Splunk in CSV format before migrating it to Azure. After you export your data, you can [select a target Azure platform for your exported historical data](migration-ingestion-target-platform.md), and then [select a data ingestion tool for migrating historical data](migration-ingestion-tool.md). :::image type="content" source="media/migration-export-ingest/export-data.png" alt-text="Diagram illustrating steps involved in export and ingestion." border="false"::: -You can export data from Splunk in several ways. Your selection of an export method depends on the data volumes involved and your level of interactivity. For example, exporting a single, on-demand search via Splunk Web might be appropriate for a low-volume export. Alternatively, if you want to set up a higher-volume, scheduled export, the SDK and REST options work best. +You can export data from Splunk in several ways. Your selection of an export method depends on the data volumes involved and your level of interactivity. For example, exporting a single, on-demand search via Splunk Web might be appropriate for a low-volume export. Alternatively, if you want to set up a higher-volume, scheduled export, the SDK and REST options work best. For large exports, the most stable method for data retrieval is `dump` or the Command Line Interface (CLI). You can export the logs to a local folder on the Splunk server or to another server accessible by Splunk. -To export your historical data from Splunk, use one of the [Splunk export methods](https://docs.splunk.com/Documentation/Splunk/8.2.5/Search/Exportsearchresults). The output format should be CSV. +To export your historical data from Splunk, use one of the [Splunk export methods](https://docs.splunk.com/Documentation/Splunk/8.2.5/Search/Exportsearchresults). The output format should be CSV. ## CLI example @@ -32,9 +32,10 @@ This CLI example searches for events from the `_internal` index that occur durin This CLI command exports data recorded between 23:59 and 01:00 on September 14, 2021 to a CSV file: -```+```spl splunk search "index=_internal earliest=09/14/2021:23:59:00 latest=09/16/2021:01:00:00 " -output csv > c:/data.csv ```+ ## dump example This `dump` command exports all events from the `bigdata` index to the `YYYYmmdd/HH/host` location under the `$SPLUNK_HOME/var/run/splunk/dispatch/<sid>/dump/` directory on a local disk. The command uses `MyExport` as the prefix for export filenames, and outputs the results to a CSV file. The command partitions the exported data using the `eval` function before the `dump` command.@@ -42,7 +43,8 @@ This `dump` command exports all events from the `bigdata` index to the `YYYYmmdd ```spl index=bigdata | eval _dstpath=strftime(_time, "%Y%m%d/%H") + "/" + host | dump basefilename=MyExport format=csv ```-## Next steps++## Related content - [Select a target Azure platform to host the exported historical data](migration-ingestion-target-platform.md) - [Choose a data ingestion tool for historical data migration](migration-ingestion-tool.md)