Hi bow One easy way although not very automated way is to use the "Show Source" entry in the "Event Actions" context menu Another question similar to yours has been asked here: http://answers.splunk.com/answers/2602/can-splunk-filtermatch-events-and-bring-back-neighbouring-events-like-gnu-grep You might get lucky with a combination of localize and map(Documentation of localize😞 error | localize | map search="search starttimeu::$starttime$ endtimeu::$endtime$ I don't know of a way to export the entire source once search is limited to not show all the events. ... View more