exporting data does not have host information

[creativenitin]

I want to export my logs to a file(raw text) from the search i have done. It does it but problem is it does not include the source of those logs viz hostname the sourcetype etc. Is there a way this information can be exported in raw text exports? I also did not find this in csv format too.

thanks
nitn

[yannK]

No, raw format is supposed to contain only the raw event. (the content of the hidden field _raw)

If you want more details, try to build a table, with the fields you want.

mysearch | eval raw=_raw | table _time host source sourcetype raw


Or edit the raw event to add the fields

mysearch | eval _raw="time="._time." host=".host." sourcetype=".sourcetype." source=".source." raw="._raw