I run a custom search which produces 6,091 matching events. I would like to export those events.
When I export in CSV format, I get 6,091 rows in the result set.
However, when I export in RAW format, I get 17 results. I have tried using different browsers, etc., but the result is the same.
Is this a known issue? I searched the version issues and change log but these symptoms are not mentioned.
I am running Splunk 5.0.1 (build 143156).
My guess is that your root search only had 17 events, and you used lookups etc to get to 6091 rows. So that when you export _raw, there were only 17 root events which were "enriched" to become 6091 rows.