How to export real raw events from Splunk?

[orion44]

Other answers imply that | table _raw | outputcsv is the method to export raw events from Splunk. However a csv file is not raw events as it, by design, is structured data.

I can export real raw events from the GUI via Search > Export > Format: Raw Events > Done.

How can this be done programmatically?

[orion44 · Accepted solution]

Solution: Use Splunk CLI to export the raw data.

splunk search "index=data earliest=-1h@h latest=@h" -output rawdata -maxout 200000 > "F:\Splunk Export\raw.txt"

[chrisyounger]

I would argue that a CSV file with only one column in it (_raw) is not really structured data, becuase it doesn't even have any commas in it (unless they are in the raw data)...

I think this would be your best option.