Copy windows logs in raw mode

[splunkcol]

I currently find myself collecting logs using the windows universal forwarder, my client has requested a copy of the logs that have been collected from the windows sources for the last 2 months.

Is there any way to access this information or the only way is to run a query like index=main |fields _raw

[dtburrows3 · Accepted solution]

You should be able to export _raw search results from a search head as a flat text file. You can see the export button next to the dropdown selector for search mode to run.

dtburrows3_0-1704395512049.png
From here you just select "Raw Events" and name the file, then click "Export"

dtburrows3_1-1704395632842.png

dtburrows3_2-1704395672311.png