Export Search Results from Log Management

Export the complete result set of a Log Management search in Radiant Security and download it through a secure, time-limited link.

Log Management shows up to 400 rows per search in the interface, enough to scan and pivot but not to take the full result set with you. Exporting removes that ceiling: you pull the complete set of matching records yourself, on demand, for any index and any window within your retention, without filing a request or waiting on anyone else. Hunt across long time ranges, assemble evidence for an audit or investigation, or move a dataset into another tool for deeper analysis.

Radiant runs the export against the index and time range you selected, packages every matching record into a single compressed file, and emails you a link to download it. Export works whether your tenant uses Radiant-managed storage or your own bucket (BYOB).

Export search results

To export the full result set of a search:

1. In Radiant Security, open Log Management from the navigation menu.
2. Click the Index Selector and choose the index you want to export: Parsed events, Unparsed events, Alerts, or Audit logs.

1. Set your search window with the time range picker in the top-right toolbar (e.g., Last 7 Days).
2. Enter your query and click Run. For query syntax, see Craft search queries in Log Management.
3. Click Export.
4. Radiant emails a download link to the address on your account when the file is ready. Open the email and click the link to download the export, a gzip-compressed file of newline-delimited JSON (NDJSON) with one record per line.

You can leave Log Management while Radiant prepares the export. The link opens a Radiant Security page that confirms you are signed in as the account that requested the export before the download starts, and it expires 24 hours after it is sent. After it expires, run the export again to generate a new link.

Export range and limits

The export range follows your tenant's retention, applied per index:

• Bring your own bucket (BYOB): up to 366 days per index
• Radiant-managed storage: up to 60 days

High-volume indexes such as Parsed Events can return very large result sets.

An export that would exceed 5 GB fails. If your export fails, narrow the time range or tighten your query to reduce the result set, then run the export again.