https://community.splunk.com/t5/Splunk-Enterprise-Security/Export-the-raw-source-files/m-p/561741#M10159 <P>You can export the results of any search in CSV, JSON, or XML format. Just click on the export button just below the time picker.</P><P>To limit the amount of data you pull down you can limit your search results by excluding everything but _raw. You might also want to limit the number log files in your search as well.<BR /><BR />Example:<BR />&nbsp;index="con1_batch" source="*/PB00E5*/log/*.log" | fields + _raw |table _raw</P> Mon, 02 Aug 2021 19:31:20 GMT codebuilder 2021-08-02T19:31:20Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Export-the-raw-source-files/m-p/561738#M10158 <P>Is there a way to export each raw source files?&nbsp;<BR /><BR />Example of my search criteria:</P><P>&nbsp;index="con1_batch" source="*/PB00E5*/log/*.log"</P><P>Top 10 Values Count %<BR />/con7/var/batch/PB00E533/log/PB00E533.BatchEdbc.20210718031834.log 29,154 1.92%<BR />/con7/var/batch/PB00E517/log/PB00E517.BatchEdbc.20210718031918.log 28,679 1.889%<BR />/con7/var/batch/PB00E587/log/PB00E587.BatchEdbc.20210718031918.log 28,667 1.888%<BR />/con7/var/batch/PB00E551/log/PB00E551.BatchEdbc.20210718031936.log 28,643 1.887%<BR />/con7/var/batch/PB00E583/log/PB00E583.BatchEdbc.20210718031849.log 28,512 1.878%<BR />/con7/var/batch/PB00E530/log/PB00E530.BatchEdbc.20210718031841.log 28,433 1.873%<BR />/con7/var/batch/PB00E590/log/PB00E590.BatchEdbc.20210718032104.log 28,330 1.866%<BR />/con7/var/batch/PB00E548/log/PB00E548.BatchEdbc.20210718031953.log 28,157 1.855%<BR />/con7/var/batch/PB00E550/log/PB00E550.BatchEdbc.20210718031907.log 28,114 1.852%<BR />/con7/var/batch/PB00E584/log/PB00E584.BatchEdbc.20210718031838.log 28,061 1.848%</P><P>...</P><P>There are 100+ source files. Can I download or export all the individual source file?</P> Mon, 02 Aug 2021 18:26:38 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Export-the-raw-source-files/m-p/561738#M10158 sinha73 2021-08-02T18:26:38Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Export-the-raw-source-files/m-p/561741#M10159 <P>You can export the results of any search in CSV, JSON, or XML format. Just click on the export button just below the time picker.</P><P>To limit the amount of data you pull down you can limit your search results by excluding everything but _raw. You might also want to limit the number log files in your search as well.<BR /><BR />Example:<BR />&nbsp;index="con1_batch" source="*/PB00E5*/log/*.log" | fields + _raw |table _raw</P> Mon, 02 Aug 2021 19:31:20 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Export-the-raw-source-files/m-p/561741#M10159 codebuilder 2021-08-02T19:31:20Z