There is my search result in the attached image.
What I want to do is to expand the count field and show all events as my search result. Simply the same function if clicking the count value and choose "View Events".
Is this possible?
If you want to have all raw events in your results table as well, you can simply include this in your stats
command. Just add a list(_raw) as RawEvents
to the already existing SPL, which powers the shown search. Just be aware, that this might enlarge your results table quite a bit 🙂
If you want to have all raw events in your results table as well, you can simply include this in your stats
command. Just add a list(_raw) as RawEvents
to the already existing SPL, which powers the shown search. Just be aware, that this might enlarge your results table quite a bit 🙂
Hi @DMohn,
Thank you for your tips!
Solved my problem with appendcols command.