Other answers imply that | table _raw | outputcsv is the method to export raw events from Splunk. However a csv file is not raw events as it, by design, is structured data.
| table _raw | outputcsv
I can export real raw events from the GUI via Search > Export > Format: Raw Events > Done.
How can this be done programmatically?
I would argue that a CSV file with only one column in it (_raw) is not really structured data, becuase it doesn't even have any commas in it (unless they are in the raw data)...
I think this would be your best option.
Solution: Use Splunk CLI to export the raw data.
splunk search "index=data earliest=-1h@h latest=@h" -output rawdata -maxout 200000 > "F:\Splunk Export\raw.txt"
View solution in original post