Archive

How to export real raw events from Splunk?

Communicator

Other answers imply that | table _raw | outputcsv is the method to export raw events from Splunk. However a csv file is not raw events as it, by design, is structured data.

I can export real raw events from the GUI via Search > Export > Format: Raw Events > Done.

How can this be done programmatically?

Tags (1)
0 Karma
1 Solution

Communicator

Solution: Use Splunk CLI to export the raw data.

splunk search "index=data earliest=-1h@h latest=@h" -output rawdata -maxout 200000 > "F:\Splunk Export\raw.txt"

View solution in original post

Communicator

Solution: Use Splunk CLI to export the raw data.

splunk search "index=data earliest=-1h@h latest=@h" -output rawdata -maxout 200000 > "F:\Splunk Export\raw.txt"

View solution in original post

SplunkTrust
SplunkTrust

I would argue that a CSV file with only one column in it (_raw) is not really structured data, becuase it doesn't even have any commas in it (unless they are in the raw data)...

I think this would be your best option.

0 Karma