Getting Data In

How to export real raw events from Splunk?

orion44
Communicator

Other answers imply that | table _raw | outputcsv is the method to export raw events from Splunk. However a csv file is not raw events as it, by design, is structured data.

I can export real raw events from the GUI via Search > Export > Format: Raw Events > Done.

How can this be done programmatically?

Tags (1)
0 Karma
1 Solution

orion44
Communicator

Solution: Use Splunk CLI to export the raw data.

splunk search "index=data earliest=-1h@h latest=@h" -output rawdata -maxout 200000 > "F:\Splunk Export\raw.txt"

View solution in original post

orion44
Communicator

Solution: Use Splunk CLI to export the raw data.

splunk search "index=data earliest=-1h@h latest=@h" -output rawdata -maxout 200000 > "F:\Splunk Export\raw.txt"

chrisyounger
SplunkTrust
SplunkTrust

I would argue that a CSV file with only one column in it (_raw) is not really structured data, becuase it doesn't even have any commas in it (unless they are in the raw data)...

I think this would be your best option.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...