topic How to export real raw events from Splunk? in Getting Data In https://community.splunk.com/t5/Getting-Data-In/How-to-export-real-raw-events-from-Splunk/m-p/450147#M95694 <P>Other answers imply that <CODE>| table _raw | outputcsv</CODE> is the method to export raw events from Splunk. However a csv file is not raw events as it, by design, is structured data.</P> <P>I can export real raw events from the GUI via Search &gt; Export &gt; Format: Raw Events &gt; Done. </P> <P>How can this be done programmatically?</P> Sat, 09 Feb 2019 21:59:27 GMT orion44 2019-02-09T21:59:27Z How to export real raw events from Splunk? https://community.splunk.com/t5/Getting-Data-In/How-to-export-real-raw-events-from-Splunk/m-p/450147#M95694 <P>Other answers imply that <CODE>| table _raw | outputcsv</CODE> is the method to export raw events from Splunk. However a csv file is not raw events as it, by design, is structured data.</P> <P>I can export real raw events from the GUI via Search &gt; Export &gt; Format: Raw Events &gt; Done. </P> <P>How can this be done programmatically?</P> Sat, 09 Feb 2019 21:59:27 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-export-real-raw-events-from-Splunk/m-p/450147#M95694 orion44 2019-02-09T21:59:27Z Re: How to export real raw events from Splunk? https://community.splunk.com/t5/Getting-Data-In/How-to-export-real-raw-events-from-Splunk/m-p/450148#M95695 <P>I would argue that a CSV file with only one column in it (_raw) is not really structured data, becuase it doesn't even have any commas in it (unless they are in the raw data)...</P> <P>I think this would be your best option.</P> Sat, 09 Feb 2019 22:27:12 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-export-real-raw-events-from-Splunk/m-p/450148#M95695 chrisyounger 2019-02-09T22:27:12Z Re: How to export real raw events from Splunk? https://community.splunk.com/t5/Getting-Data-In/How-to-export-real-raw-events-from-Splunk/m-p/450149#M95696 <P>Solution: Use Splunk CLI to export the raw data.</P> <PRE><CODE>splunk search "index=data earliest=-1h@h latest=@h" -output rawdata -maxout 200000 &gt; "F:\Splunk Export\raw.txt" </CODE></PRE> Wed, 13 Feb 2019 10:00:08 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-export-real-raw-events-from-Splunk/m-p/450149#M95696 orion44 2019-02-13T10:00:08Z