Skip to main content
Sumo Logic

Export the Results of a Saved File


Sumo Logic provides the ability to save a file using the save operator, but it does not allow you to export the results of that saved file. To do so, you would have to re-run the original query and export the results.

But if you know you will need to export your saved files results routinely, you can create another column in the results that are saved to the file that acts as a primary key for each result. This key then allows you to conduct a lookup operation matching the key.

To create keys in your saved file:

  1. In your query that is saving the file with the save operator, you need to add numbers to act as the primary key. You can start at 1 and increment by 1 for each result, as shown. Add a group by if needed (such as a timeslice):

| 1 as number
| accum number as number // by _timeslice

  1. Now that your saved file has numbers as unique keys on each result you can do a lookup so that the matching is done on the keys, like this:

| 1 as number
| accum number as key
| lookup * from shared/file.csv on key=number

  1. If you are appending to your saved file, you can get the file's last key to define the starting key for the append query using the following query:

| 1 as number
| accum number as key
| lookup _accum from shared/file/forsupport on key=_accum
| max(_accum)
| _max + 1 as key