Adding tab character \t to a string

[paramagurukarth]

I am trying to export data from splunk using splukCLI as given here 

splunk search "index=_internal earliest=09/14/2015:23:59:00 latest=09/16/2015:01:00:00 " -output rawdata -maxout 200000 > c:/test123.dmp 

Just want to print event fields seperated by tab character instaed of '\t' as string

tried something like 

...eval _raw=field1 + "<tabchar_copied_from_notpad>" + field2 + ...

Results in improper character whcih behaves differently in different OS

and 

...eval _raw=field1 + "\t" + field2 + ...

Results in "\t" avaiable in _raw as regular two characters.. not as a single tab character
Any cleaner way to achieve it

[paramagurukarth]

I am just trying to feed data into another repoerting solution that uses fielbeat. That monitors log files. Plan is to feed the exported content to filebeat

[tshah-splunk]

Hey @paramagurukarth,

I think you can achieve that in a better way if the results are exported in CSV or JSON or XML format. It would be quite simpler to separate the fields based on delimiter instead of tab characters. If there is any specific use case or reason for exporting the data into rawdata format, please feel free to share the details.