https://community.splunk.com/t5/Knowledge-Management/exporting-data-does-not-have-host-information/m-p/27706#M7035 <P>No, raw format is supposed to contain only the raw event. (the content of the hidden field _raw)</P> <P>If you want more details, try to build a table, with the fields you want.<BR /> <CODE><BR /> mysearch | eval raw=_raw | table _time host source sourcetype raw<BR /> </CODE></P> <P>Or edit the raw event to add the fields<BR /> <CODE><BR /> mysearch | eval _raw="time="._time." host=".host." sourcetype=".sourcetype." source=".source." raw="._raw<BR /> </CODE></P> Mon, 28 Sep 2020 11:40:53 GMT yannK 2020-09-28T11:40:53Z https://community.splunk.com/t5/Knowledge-Management/exporting-data-does-not-have-host-information/m-p/27705#M7034 <P>I want to export my logs to a file(raw text) from the search i have done. It does it but problem is it does not include the source of those logs viz hostname the sourcetype etc. Is there a way this information can be exported in raw text exports? I also did not find this in csv format too.</P> <P>thanks<BR /> nitn</P> Mon, 16 Apr 2012 18:13:29 GMT https://community.splunk.com/t5/Knowledge-Management/exporting-data-does-not-have-host-information/m-p/27705#M7034 creativenitin 2012-04-16T18:13:29Z https://community.splunk.com/t5/Knowledge-Management/exporting-data-does-not-have-host-information/m-p/27706#M7035 <P>No, raw format is supposed to contain only the raw event. (the content of the hidden field _raw)</P> <P>If you want more details, try to build a table, with the fields you want.<BR /> <CODE><BR /> mysearch | eval raw=_raw | table _time host source sourcetype raw<BR /> </CODE></P> <P>Or edit the raw event to add the fields<BR /> <CODE><BR /> mysearch | eval _raw="time="._time." host=".host." sourcetype=".sourcetype." source=".source." raw="._raw<BR /> </CODE></P> Mon, 28 Sep 2020 11:40:53 GMT https://community.splunk.com/t5/Knowledge-Management/exporting-data-does-not-have-host-information/m-p/27706#M7035 yannK 2020-09-28T11:40:53Z