I want to export my logs to a file(raw text) from the search i have done. It does it but problem is it does not include the source of those logs viz hostname the sourcetype etc. Is there a way this information can be exported in raw text exports? I also did not find this in csv format too.
thanks
nitn
No, raw format is supposed to contain only the raw event. (the content of the hidden field _raw)
If you want more details, try to build a table, with the fields you want.
mysearch | eval raw=_raw | table _time host source sourcetype raw
Or edit the raw event to add the fields
mysearch | eval _raw="time="._time." host=".host." sourcetype=".sourcetype." source=".source." raw="._raw