Bug in Export Raw events

[steveirogers]

I run a custom search which produces 6,091 matching events. I would like to export those events.
When I export in CSV format, I get 6,091 rows in the result set.
However, when I export in RAW format, I get 17 results. I have tried using different browsers, etc., but the result is the same.

Is this a known issue? I searched the version issues and change log but these symptoms are not mentioned.

I am running Splunk 5.0.1 (build 143156).

[jkat54]

My guess is that your root search only had 17 events, and you used lookups etc to get to 6091 rows. So that when you export _raw, there were only 17 root events which were "enriched" to become 6091 rows.