https://community.splunk.com/t5/Getting-Data-In/raw-data/m-p/693903#M115322 <P>Correct. The _raw field contains the data in the event that is indexed in Splunk. This data can differ from the raw data of the sending device depending on the index-time processing has been applied to it.</P> Sun, 21 Jul 2024 08:06:55 GMT marnall 2024-07-21T08:06:55Z https://community.splunk.com/t5/Getting-Data-In/raw-data/m-p/693902#M115321 <P>_raw data exported from a search query. This not the actual raw data stream from the sending device, correct? This is the data after any default rules have been applied at index time.&nbsp;</P> Sun, 21 Jul 2024 04:25:20 GMT https://community.splunk.com/t5/Getting-Data-In/raw-data/m-p/693902#M115321 splunkville 2024-07-21T04:25:20Z https://community.splunk.com/t5/Getting-Data-In/raw-data/m-p/693903#M115322 <P>Correct. The _raw field contains the data in the event that is indexed in Splunk. This data can differ from the raw data of the sending device depending on the index-time processing has been applied to it.</P> Sun, 21 Jul 2024 08:06:55 GMT https://community.splunk.com/t5/Getting-Data-In/raw-data/m-p/693903#M115322 marnall 2024-07-21T08:06:55Z