Skip to main content
Sumo Logic

Export the Results of a Saved File

Sumo Logic provides the ability to save a file using the save operator, but it does not allow you to export the results of that saved file. To do so, you would have to re-run the original query and export the results.

But if you know you will need to export your saved files results routinely, you can create another column in the results that are saved to the file that acts as a primary key for each result. This key then allows you to conduct a lookup operation matching the key.

To create keys in your saved file:

  1. In your query, start at 1 and increment by 1 for each result, as shown. Add a group by if needed (such as a timeslice):

| 1 as number
| accum number as number // by _timeslice

  1. Now that your saved file has a unique key on each result, you can do a lookup so that the matching is done on the keys, like this:

| 1 as number
| accum number as key
| lookup * from shared/file.csv on key=number

  1. If you are appending to your saved file, you can get the file's last key to define the starting key for the append query using the following query:

| 1 as number
| accum number as key
| lookup _accum from shared/file/forsupport on key=_accum
| max(_accum)
| _max + 1 as key