Splunk Search

How to export raw events instead of statistics?

Woodpecker
Path Finder

Hi,

I have a query which gives a table of results. Now instead of exporting the table, I need to export the raw events itself. How can I do that?

Instead of exporting 9980 values, I need to export the whole 16882 events

Any help would be appreciated!

Tags (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

When you click the Export icon, choose "Raw events" from the Format dropdown.

---
If this reply helps you, Karma would be appreciated.
0 Karma

Woodpecker
Path Finder

I want to enable a email alert action and export the results as raw events

0 Karma

richgalloway
SplunkTrust
SplunkTrust

That's an option in the alert action.

richgalloway_0-1679316603353.png

 

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Splunk Enterprise Security(ES) 7.3 is approaching the end of support. Get ready for ...

Hi friends!    At Splunk, your product success is our top priority. With Enterprise Security (ES), we're here ...

Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...

Watch On Demand the Tech Talk, and empower your SOC to reach new heights! Duration: 1 hour  Prepare to ...

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...