if i wanted to get a copy of the uncooked or raw syslogs from splunk how would i do that?
exporttool seems to only export csv and not raw syslogs.
You can run a search to bring back all of the raw events that you would like to export over the time range that is appropriate.
then append this to the end of our search:
| table _raw | outputcsv
The outputcsv file containing your results should be in $SPLUNK_HOME/var/run/splunk/ directory.
Given your reference to exporttool, I'd imagine that the other answers here aren't quite right, as they deal with streaming data out at the same time it's indexed.
You probably want to look at the export capabilities added to CLI search in version 4.1. A CLI search like the following will stream all events out of the index to standard out, and can be piped into other programs or redirected into other files:
splunk search '*' -maxout 0 splunk search '*' -maxout 0 | wc -l splunk search '*' -maxout 0 > exportfile.txt
You can replace the '*' here with any search on keywords or fields. In fact, as long as the search is non-transforming (no stats, sort, timechart, top, ...) you can use other search commands like lookup, eval, where, regex.