Splunk Search

Copy windows logs in raw mode

splunkcol
Builder

 

I currently find myself collecting logs using the windows universal forwarder, my client has requested a copy of the logs that have been collected from the windows sources for the last 2 months.

Is there any way to access this information or the only way is to run a query like index=main |fields _raw

 

 

Labels (1)
0 Karma
1 Solution

dtburrows3
Builder

You should be able to export _raw search results from a search head as a flat text file. You can see the export button next to the dropdown selector for search mode to run.

dtburrows3_0-1704395512049.png
From here you just select "Raw Events" and name the file, then click "Export"

dtburrows3_1-1704395632842.png

dtburrows3_2-1704395672311.png

 

 

View solution in original post

dtburrows3
Builder

You should be able to export _raw search results from a search head as a flat text file. You can see the export button next to the dropdown selector for search mode to run.

dtburrows3_0-1704395512049.png
From here you just select "Raw Events" and name the file, then click "Export"

dtburrows3_1-1704395632842.png

dtburrows3_2-1704395672311.png

 

 

Get Updates on the Splunk Community!

Accelerate Service Onboarding, Decomposition, Troubleshooting - and more with ITSI’s ...

Accelerate Service Onboarding, Decomposition, Troubleshooting - and more! Faster Time to ValueManaging and ...

New Release | Splunk Enterprise 9.3

Admins and Analyst can benefit from:  Seamlessly route data to your local file system to save on storage ...

2024 Splunk Career Impact Survey | Earn a $20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...