Add an event listing
An event visualization is essentially a raw list of events. You can get event visualizations from any search that does not include a transform operation. Transform operations use reporting commands such as
Configure the event listing panel
The following example displays access errors as a list of events. The search for the panel is from a saved search.
This panel specifies the following:
- Display 15 rows of returned data
- Do not include the row numbers
- Include a maximum of 10 lines of data for each event
- Wrap long lines of returned data
<dashboard> <label>Event Listing Dashboard</label> <row> <event> <searchName>Errors in the last 24 hours</searchName> <title>Errors in the last 24 hours</title> <option name="count">15</option> <option name="displayRowNumbers">false</option> <option name="maxLines">10</option> <option name="softWrap">true</option> </event> </row> </dashboard>
Configure event listing specific options
For basic configuration of event listings, refer to the "Event panel entry" in the Panel reference for Simplified XML.
Add a single value and gauges
Build a real-time dashboard
This documentation applies to the following versions of Splunk® Enterprise: 4.3, 4.3.1, 4.3.2, 4.3.3, 4.3.4, 4.3.5, 4.3.6, 4.3.7