Skip to main content

Import Raw Data from Splunk

Follow the steps below to import raw data from Splunk into Sumo Logic.


Although you can import data from Splunk, Sumo Logic does not support Splunk functionality or any commands included below.

  1. Do one of the following:
    • Use the Splunk search command to construct queries that return a group of messages that match source configurations in Sumo Logic (e.g., multiline detection, timezone settings). For example, messages that match Unix logs and messages that match Windows logs. Then, export these messages using the splunk search command (at the command-line) with the -output rawdata option to individual files (with a simple redirect). Each file in turn can then be configured to be picked up by Sumo Logic.
    • Use the Splunk export eventdata command. This automatically creates copies of the original raw files for an index. Then you can pick and choose which of these you want to get to Sumo Logic using collector sources and configure each one according to your needs. 
  2. Configure your Sumo Logic Sources to pick up the logs from the directories you've just exported.
Privacy Statement
Terms of Use

Copyright © 2024 by Sumo Logic, Inc.