Splunk Search

How to expand the count field and show all the events as a search result?

jyab6z
Path Finder

There is my search result in the attached image.

What I want to do is to expand the count field and show all events as my search result. Simply the same function if clicking the count value and choose "View Events".

Is this possible?

alt text

0 Karma
1 Solution

DMohn
Motivator

If you want to have all raw events in your results table as well, you can simply include this in your stats command. Just add a list(_raw) as RawEvents to the already existing SPL, which powers the shown search. Just be aware, that this might enlarge your results table quite a bit 🙂

View solution in original post

0 Karma

DMohn
Motivator

If you want to have all raw events in your results table as well, you can simply include this in your stats command. Just add a list(_raw) as RawEvents to the already existing SPL, which powers the shown search. Just be aware, that this might enlarge your results table quite a bit 🙂

0 Karma

jyab6z
Path Finder

Hi @DMohn,

Thank you for your tips!
Solved my problem with appendcols command.

0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...