Re: How to export raw events instead of statistics... - Splunk Community

Splunk Search

Hi,

I have a query which gives a table of results. Now instead of exporting the table, I need to export the raw events itself. How can I do that?

Instead of exporting 9980 values, I need to export the whole 16882 events

Any help would be appreciated!

When you click the Export icon, choose "Raw events" from the Format dropdown.

---
If this reply helps you, Karma would be appreciated.

I want to enable a email alert action and export the results as raw events

That's an option in the alert action.

---
If this reply helps you, Karma would be appreciated.

Get Updates on the Splunk Community!

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Are you leveraging automation to its fullest potential in your threat detection strategy?Our upcoming Security ...

Can’t Make It to Boston? Stream .conf25 and Learn with Haya Husain

Boston may be buzzing this September with Splunk University and .conf25, but you don’t have to pack a bag to ...

Splunk Lantern’s Guide to The Most Popular .conf25 Sessions

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...