Splunk Search

Copy windows logs in raw mode

splunkcol
Builder

 

I currently find myself collecting logs using the windows universal forwarder, my client has requested a copy of the logs that have been collected from the windows sources for the last 2 months.

Is there any way to access this information or the only way is to run a query like index=main |fields _raw

 

 

Labels (1)
0 Karma
1 Solution

dtburrows3
Builder

You should be able to export _raw search results from a search head as a flat text file. You can see the export button next to the dropdown selector for search mode to run.

dtburrows3_0-1704395512049.png
From here you just select "Raw Events" and name the file, then click "Export"

dtburrows3_1-1704395632842.png

dtburrows3_2-1704395672311.png

 

 

View solution in original post

dtburrows3
Builder

You should be able to export _raw search results from a search head as a flat text file. You can see the export button next to the dropdown selector for search mode to run.

dtburrows3_0-1704395512049.png
From here you just select "Raw Events" and name the file, then click "Export"

dtburrows3_1-1704395632842.png

dtburrows3_2-1704395672311.png

 

 

Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...