Copy windows logs in raw mode

[splunkcol]

I currently find myself collecting logs using the windows universal forwarder, my client has requested a copy of the logs that have been collected from the windows sources for the last 2 months.

Is there any way to access this information or the only way is to run a query like index=main |fields _raw

[dtburrows3 · Accepted solution]

You should be able to export _raw search results from a search head as a flat text file. You can see the export button next to the dropdown selector for search mode to run.

From here you just select "Raw Events" and name the file, then click "Export"